Memory corruption in Microsoft Office and Microsoft Word - CVE-2018-0802

Vulnerability identifier: #VU9896

CSH Severity: Critical

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-0802

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing Microsoft Word documents. A remote attacker can create a specially crafted Word document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office or Microsoft WordPad software.

Note: the vulnerability is being exploited in the wild.

Microsoft Office
Microsoft Word

Install updates from vendor's website.

• Exploit #8206 - rtfkit (generate RTF exploit payload. uses cve-2017-11882, cve-2017-8570, cve-2018-0802, and cve-2018-8174.) (August 2, 2022)
• Exploit #4842 - rtfkit (generate RTF exploit payload. uses cve-2017-11882, cve-2017-8570, cve-2018-0802, and cve-2018-8174.) (November 17, 2020)
• Exploit #2774 - CPR-Zero: CVE-2018-0802 (May 18, 2020)
• Exploit #1915 - CVE-2018-0802 (PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)) (March 18, 2020)
• Exploit #177 - CVE-2018-0802_POC (Exploit the vulnerability to execute the calculator) (March 18, 2020)
• Exploit #178 - CVE-EXPLOIT-DB () (March 18, 2020)

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802

• Remote code execution in Microsoft Word