Remote Code Execution Vulnerability in Microsoft Office (CVE‑2018‑0798) Enables Memory Corruption
What It Is — Microsoft Office contains a memory‑corruption flaw (CVE‑2018‑0798) that can be triggered by specially‑crafted objects. Successful exploitation results in remote code execution (RCE) in the context of the currently logged‑in user. The vulnerability is frequently chained with CVE‑2018‑0802 to increase impact.
Exploitability — Publicly disclosed; proof‑of‑concept code exists. CVSS v3.1 base score 7.8 (High). No known active ransomware or nation‑state campaign, but the exploit path is straightforward for an attacker with a malicious document.
Affected Products — Microsoft Office 2010, 2013, 2016, 2019 and Microsoft 365 desktop clients on Windows.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls and auditable patch‑deployment evidence.
- A missing or delayed patch can break the “defensible evidence” required in audits that span NIST CSF, ISO 27001, and other frameworks.
- Shows how a single un‑remediated flaw can cascade (via CVE‑2018‑0802) into a broader attack surface, stressing the importance of integrated control mapping across the organization’s security stack.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2018‑0798 across all Office installations immediately.
- Verify patch rollout with an automated inventory scan and capture remediation logs as evidence.
- Update your vulnerability‑management policy to include regular checks for legacy Office versions still in use.
- Document the remediation process in your Trust Center to streamline future audit requests.
Source: CISA KEV – CVE‑2018‑0798