'By inserting several OLEs that exploited the described vulnerability, it was possible to execute an arbitrary sequence of commands (e.g. Using Microsoft's own BinScope binary verification tool, it didn't take long for researchers to find two memory corruption (buffer overflow) vulnerabilities in the EQNEDT32.EXE file.

EQNEDT32.EXE buffer overflow allows remote code executionĪ closer look at the file confirmed the researcher's worst fears, as the EQNEDT32.EXE component spawned its own process, outside the main Office process, that did not utilize any of the security features added to Windows 10 or the Office suite. Subsequent sleuthing revealed that the component was replaced by a new equation editor in Office 2007, but Microsoft left the old one inside Office to make sure the Office software suite could open documents that featured equations made in older Office versions.

This tool, as the name obviously implies, allows users to embed mathematical equations inside Office documents as dynamic OLE objects.Įmbedi discovered that Microsoft was still using a version of the EQNEDT32.EXE file that was compiled on November 9, 2000, meaning it was running on very old code that featured out-of-date libraries and did not use any of the recent security features added to Windows OS releases. Vulnerability resides in the old Office equation editorĭiscovered by the Embedi research team, the vulnerability affects the Microsoft Equation Editor (EQNEDT32.EXE), one of the executables that is installed on users' computers with the Office suite.

The vulnerability - tracked as CVE-2017-11882 - was patched today in the November 2017 Patch Tuesday updates. Microsoft has patched today a huge security hole in Microsoft Office that could be exploited to run malicious code without user interaction on all Windows versions released in the past 17 years.

Microsoft equation editor office 365