CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability

CVE-2018-0802 is a memory corruption vulnerability in Microsoft Office that arises from the way the software handles objects in memory. Successful exploitation can allow an attacker to execute code remotely in the context of the current user. It is known to be chained with CVE-2018-0798, which increases the practical risk for environments that still run unpatched Office installations. Defenders should treat it as a high-priority remote code execution issue in a widely deployed desktop productivity suite and confirm all version and patch details against the vendor advisory.

How it works

The underlying weakness is classified as CWE-787, an out-of-bounds write that corrupts memory. In Microsoft Office, improper handling of objects in memory can let crafted input overwrite memory outside the intended bounds. An attacker who can deliver a malicious Office document or related content may trigger this corruption to achieve remote code execution under the privileges of the logged-on user. Public detail on exact trigger conditions is limited; the CISA summary notes that the flaw stems from how objects are handled in memory and that the vulnerability has been observed chained with CVE-2018-0798. No further exploit mechanics should be assumed without reference to the vendor advisory.

Am I affected? How to find it in your systems

Microsoft Office is typically installed on Windows endpoints used by knowledge workers, including desktops, laptops, and virtual desktop infrastructure. Inventory every system that has Office components installed—word processors, spreadsheet applications, and related viewers or converters. Because exact affected builds are not listed in the provided facts, compare installed Office versions and update levels directly against the Microsoft advisory for CVE-2018-0802.

• Use software inventory tools, SCCM/ConfigMgr, Intune, or vulnerability scanners to enumerate Office installations and their patch status.
• Check for the presence of the specific security update named in the vendor advisory; absence of that update indicates potential exposure.
• Review endpoint logs and EDR telemetry for unusual Office process behavior, such as unexpected child processes, memory corruption crashes, or Office launching payloads shortly after opening a document from email or a network share.
• Hunt for indicators associated with the chained CVE-2018-0798 if your detection content covers that related issue.

Confirm all version ranges and detection signatures against the official vendor advisory before declaring systems clean or affected.

How to remediate

The primary remediation is to apply the updates Microsoft released for this vulnerability, following the vendor instructions referenced by CISA. Deploy the security update through your normal patch management channel as soon as testing confirms compatibility.

• Prioritize internet-facing or high-privilege user workstations and any systems that routinely open documents from untrusted sources.
• After patching, verify the update is present via inventory or the Office “About” / update history dialogs.
• As hardening for this class of memory-corruption bugs, enable Exploit Protection / DEP / ASLR where supported, keep Office running with the least privilege practical, and enforce Protected View for files originating from the internet or email.
• Disable unnecessary Office features or legacy file-format parsers if your environment does not require them, reducing the attack surface for object-handling flaws.

If you can't patch immediately

When immediate patching is not feasible, apply compensating controls that limit delivery and execution of malicious Office content.

• Segment user workstations from high-value servers and restrict outbound connections from Office processes where possible.
• Use email and web gateways to block or sandbox Office attachments and links; enable attachment detonation or content disarm if available.
• Apply virtual patching or WAF/IPS rules that detect known exploit patterns for this CVE family, confirming rule coverage with your security vendor.
• Enforce Protected View, disable macros by default, and consider application allow-listing so that Office cannot spawn unexpected executables.
• Increase monitoring for Office process anomalies, crash dumps indicative of memory corruption, and any post-exploitation activity tied to the current user context.

These measures reduce risk but do not replace the vendor update; schedule patching as soon as operationally possible.

If your data may have been exposed

Actively exploited memory-corruption vulnerabilities in Office can lead to endpoint compromise and subsequent data theft or lateral movement. Ransomware use specifically tied to CVE-2018-0802 is not documented in the provided facts. If you suspect exploitation, isolate affected hosts, preserve forensic evidence, and follow your incident-response process. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information have already appeared in public breach corpora.