CVE-2018-6638

Vulnerability

A stack-based buffer overflow vulnerability exists in Design Science MathType version 6.9c. The issue occurs in a function call where the first argument is a corrupted offset value and the second argument is a stack buffer [1]. This can be triggered when MathType processes a specially crafted file.

Exploitation

An attacker can exploit this vulnerability by providing a malicious file that, when opened in MathType, causes a stack buffer overflow. No authentication is required, but user interaction is needed to open the file. The specific function call with the corrupted offset allows an attacker to overwrite the stack.

Impact

Successful exploitation leads to remote code execution in the context of the user running MathType. The attacker can execute arbitrary code, potentially taking full control of the affected system, leading to data compromise or further system compromise.

Mitigation

The vulnerability is fixed in MathType version 6.9d [1]. Users should upgrade to the latest version from the vendor's download page [1] to mitigate the risk. No workarounds are available.