← All detection heuristics · CVE
high
CVE likely
CVE_2018_0798_EQUATION_NATIVE_ANOMALY
What it means
Embedded Equation Editor OLE data contains malformed, payload-like native stream bytes.
Why it fires
CVE-2018-0798 is an Equation Editor memory-corruption vulnerability in the MTEF Matrix-record parser. Some weaponized Office samples carry malformed Equation native data that is high-entropy or otherwise payload-like but does not preserve the exact public 0x60/0x61 matrix signature. The detector requires an embedded Equation Editor CLSID and an anomalous native/Ole10Native stream, so it is treated as likely CVE-2018-0798-family evidence rather than an exact match.
Other CVE heuristics
CVE_2026_34621_RELATED CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2009_3459 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2010_0188 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118