CVE_2017_11882 — Equation Editor exploitation — CVE-2017-11882

critical CVE_2017_11882

What it means

Equation Editor exploit primitive or command-stager shape.

Why it fires

CVE-2017-11882 is the Equation Editor stack buffer overflow most directly identified by an overlong MTEF FONT typeface field copied into a fixed-size stack buffer in EQNEDT32.EXE. The analyzer also emits this CVE when an obfuscated or partially malformed Equation object exposes equivalent exploitation evidence, such as an activated Equation 3.0 object carrying command-launch bytes and a remote payload target. The rule still requires exploit structure beyond a bare Equation Editor CLSID.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OOXML_XLM_MACRO_IN_WORKSHEET OLE_XLS5_LAROUX_MACRO_VIRUS OLE_VBA_XLSTART_WORKBOOK_PERSISTENCE