CVE-2018-0798Vulnerability
Microsoft Office Memory Corruption Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 3 years ago
CISA KEVAdded 3 Nov 2021
Fix due 3 May 2022
Used by ransomware: not knownCISA KEV catalogue
Fix due 3 May 2022
Used by ransomware: not knownCISA KEV catalogue
EPSS95.1%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
Nice Try Tonto Team“…he tool allows the threat actor to create malicious RTF exploits with plausible decoy content for CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798, which are the vulnerabilities in the Microsoft Equation Editor.”
Indicators reported together
named in the same reports- 518439fc23cb0b4d21c7fd39484376ffin 1 report
- e40c514739768ba04ab17ff0126c1533in 1 report
- c3d25232add0238d04864fc992e7a330in 1 report
- hxxp://137.220.176[.]165/ru/order/index.php?strPageID=234989760in 1 report
- 137.220.176[.]165in 1 report
- hxxp://www.offices-update[.]com/ru/order/index.php?strPageID=234989760in 1 report
- www.offices-update[.]comin 1 report
- offices-update[.]comin 1 report
- hxxps://137.220.176[.]165/ru/order/index.php?strPageID=in 1 report
- hxxps://137.220.176[.]165/ru/order/index.php?strPageID=167880896in 1 report
- hxxps://137.220.176[.]165/ru/news/index.php?strPageID=in 1 report
- hxxps://137.220.176[.]165/ru/news/index.php?strPageID=167880896&newsID=2022-06-21-1023in 1 report
- hxxps://137.220.176[.]165/xhome.native.page/datareader.php?sid=in 1 report
- hxxps://137.220.176[.]165/xhome.native.page/datareader.php?sid=167880896in 1 report
- hxxps://137.220.176[.]165/siteFiles/index.php?strPageID=in 1 report
- hxxps://137.220.176[.]165/siteFiles/index.php?strPageID=167880896in 1 report
- 7c138c6b6f88643d7c16e741f98e0503in 1 report
- d5d0a1a034dcefdb08d9ca51c7694a22in 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2018-0802, CVE-2017-11882
Thanks — we review every report.