Microsoft had to take action because hackers already exploited this vulnerability (see Hacker are misusing CVE-2017-11882 in Office EQNEDT32.EXE). While Microsoft replaced the old EQNEDT32.EXE component with a new component in 2007, the older file is still included in all Office installations so that users can load and edit equations that were created with the old component. The equation editor EQNEDT32.EXE, which was included in Microsoft Office until 2007 but was still shipped with Office, received an update to close the gap on November 2017 patchday (I mentioned it in the blog post Microsoft Office security updates (November 14, 2017)). It turned out that this vulnerability was present in all Microsoft Office and Windows versions for the last 17 years. An article about the bugs can also be found here.

In the summer of 2017, researchers from the cyber security company Embedi discovered a CVE-2017-11882 vulnerability in the Office formula editor.

Equation Edition s a sad chapter in Microsoft Office.

Insert equation in word grayed out