Is CVE-2018-0802 (Microsoft Office Memory Corruption) being exploited in the wild?

How CISA’s KEV listing answers the “exploited in the wild” question

CISA’s Known Exploited Vulnerabilities catalogue is the key signal here because it is reserved for flaws with reliable evidence of active exploitation. For a CVE like this one, a KEV listing is stronger practical evidence than a general vendor advisory or a theoretical proof of concept, and it means defenders should treat the issue as live exposure, not a hypothetical risk.

That matters because exploited Microsoft Office flaws often sit on endpoints that users open every day, so the control problem is usually exposure reduction, not just patch hygiene. If the vulnerable Office build is present anywhere in the estate, assume attackers may already be using it for initial access or follow-on delivery and prioritise validation accordingly.

For background on this response pattern, see CISA Known Exploited Vulnerabilities Catalog and the CVE Program.

What the Office memory corruption flaw means operationally

microsoft office memory corruption issues are especially concerning because Office documents are a common delivery path and the vulnerable code often executes in the context of a trusted desktop application. That makes the flaw more than a product defect, it becomes an endpoint compromise path that can support malware execution, credential theft, or the opening move in a broader intrusion.

Memory corruption also tends to be difficult to spot at the user level. A document may look normal, the application may continue to function, and the actual abuse can happen before any obvious crash or warning. That is why defenders should not wait for visible instability before treating the asset as exposed.

When you need the product record and official vulnerability context, use NIST National Vulnerability Database alongside the vendor advisory rather than relying on summaries or reposts.

How to prioritise remediation and prove you are done

The practical response is to confirm where Microsoft Office is installed, determine whether the affected deployment exists, and move the hosts with the highest exposure to the front of the queue. User workstations with active email intake, macro-capable document workflows, or external file exchange deserve earlier action than isolated systems with limited document handling.

If patching cannot happen immediately, reduce the blast radius by restricting document sources, tightening attachment handling, and monitoring for suspicious child processes, abnormal Office spawning behaviour, and any post-exploitation activity on the same endpoint. Because CISA marked this vulnerability for active exploitation, delay should be treated as a temporary exception with compensating controls, not as an acceptable steady state.

For this kind of urgent triage, NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is the best match for KEV-driven response, and the Vulnerability Management Guide covers prioritisation, exceptions, and verification.

Risk and Threat Considerations

Because this flaw is already in CISA’s KEV catalogue, the risk is not abstract exposure, it is active attacker interest. Office vulnerabilities are attractive because they can reach users through routine business documents, making them a practical initial-access route and a way to land on a trusted endpoint with minimal friction.

Failure mechanism: memory corruption can allow maliciously crafted content to influence Office’s execution path, which can lead to code execution or other compromise conditions on the victim system.

Impact: successful exploitation can create endpoint compromise, enable payload delivery, and provide a foothold for lateral movement, data theft, or ransomware staging.

Practitioner Guidance

What to verify: confirm the presence of Microsoft Office versions across the estate, then verify whether the vulnerable package is actually installed on user endpoints that handle untrusted documents. Do not assume “low exposure” just because the system is not publicly facing.

Decision rule: if the host can open external documents and still runs the affected Office build, treat it as urgent remediation even when there is no evidence of compromise. If patching must wait, document the exception, shorten the window, and add compensating monitoring until the fix is applied.

Practitioner takeaway: a KEV listing is the operational line between “known issue” and “active threat,” so the right response is exposure confirmation, rapid remediation, and post-compromise checking rather than passive patch scheduling.

Related resources from NHI Mgmt Group

• Is CVE-2018-0798 (Microsoft Office Memory Corruption) being exploited in the wild?
• How do you patch or mitigate CVE-2018-0802 (Microsoft Office Memory Corruption)?
• Is CVE-2015-1641 (Microsoft Office Memory Corruption) being exploited in the wild?
• Is CVE-2017-11882 (Microsoft Office Memory Corruption) being exploited in the wild?