Booby-trapped Office docs build with ThreadKit trigger CVE-2018

CVE-2017-8570 is a remote code execution vulnerability in Microsoft Office caused by improper handling of embedded OLE objects (composite monikers) in memory, and it is tracked separately from the related CVE-2017-0243. An attacker triggers it by embedding a crafted moniker object in a document, most commonly a PowerPoint .ppsx slide-show file, and persuading a user to open it; the CVSS vector confirms user interaction is required. Successful exploitation lets the attacker run arbitrary code with the victim's privileges, enabling malware delivery, data theft, and follow-on activity. Any user or organization running affected Office builds that open untrusted documents is in scope, and public reporting ties the bug to high-volume maldoc toolkits (e.g., EtterSilent, ThreadKit) and targeted attacks, including one against Ukrainian organizations. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2022-02-25, EPSS puts the 30-day exploitation probability at 89.9% (100th percentile), and public PoCs exist.

Do: Apply Microsoft's June 2017 (or later) security updates to all Office installations and audit the estate for outdated builds, since CISA KEV and EPSS data show this bug is still exploited years after the patch. As an interim mitigation, block or sandbox .ppsx (PowerPoint Show) email attachments, which are the primary delivery vector, and warn users about Office files triggering embedded object content. Prioritize remediation per CISA's KEV required action: apply updates per vendor instructions.

A memory-corruption flaw (out-of-bounds write, CWE-787) in the legacy Equation Editor component (EQNEDT32.EXE) shipped with Microsoft Office 2007, 2010, 2013, and 2016 allows remote code execution due to improper handling of objects in memory. An attacker triggers it by persuading a user to open a specially crafted document (for example an RTF or DOCX containing a malformed embedded equation object), causing the Equation Editor process to corrupt memory when the file is opened in Word; the user-interaction requirement is reflected in the CVSS 3.1 vector (AV:L/UI:R). Successful exploitation gives the attacker code execution in the context of the current user, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.8, High). Any user of the affected Office versions, the Office Compatibility Pack, or Word on an unpatched system is affected. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, carries a 93.3% EPSS probability of exploitation within 30 days, and multiple public analyses and proof-of-concepts exist.

Do: Apply Microsoft's January 2018 security updates for Office 2007, 2010, 2013, and 2016 and the Office Compatibility Pack, and verify the legacy Equation Editor executable (EQNEDT32.EXE) on endpoints has been patched or removed (Microsoft later retired the component). Because the flaw is exploited in the wild and used in ransomware campaigns, prioritize remediation per CISA KEV required action and hunt for Word spawning EQNEDT32.EXE or unexpected child processes when documents are opened. Until patched, open untrusted documents in Protected View and treat email-delivered RTF/DOCX attachments as untrusted.

CVE-2018-4878 is a use-after-free (CWE-416) in Adobe Flash Player before 28.0.0.161, caused by a dangling pointer in the Primetime SDK's media-player handling of listener objects. An attacker triggers it by persuading a user to open attacker-controlled Flash content — typically a malicious SWF delivered via email, Office documents, or malvertising/exploit kits — because the CVSS vector (AV:L, UI:R) requires local user interaction. Successful exploitation yields arbitrary code execution with the privileges of the user running Flash. Anyone running a vulnerable Flash Player was exposed, including Red Hat Enterprise Linux Desktop/Server/Workstation users running Red Hat's packaged Flash plugin. The flaw was exploited as a zero-day in January–February 2018 (documented by McAfee and distributed alongside the Fallout exploit kit), and it remains in CISA's KEV with known ransomware use.

Do: Upgrade Adobe Flash Player to 28.0.0.161 or later, including Red Hat's flash-plugin package on RHEL Desktop/Server/Workstation. Because Flash is now end-of-life, CISA's required KEV action is to remove or disconnect Flash entirely where still in use — audit browsers, Office configurations, and legacy RHEL hosts for residual Flash installs, and block SWF content delivered via email and the web. Given confirmed in-the-wild exploitation, known ransomware use, and 89.5% EPSS, prioritize this in remediation tracking.