Microsoft Equation Editor

~ the obit ~

The equation editor shipped with every copy of word from 1991 to 2018, and almost nobody who used it remembered it had a name. You hit Insert > Object, picked Microsoft Equation 3.0, and got a small dialog that drew square roots and integrals in a font from 1992. It was originally a stripped-down version of Design Science's MathType, licensed to Microsoft and bundled with Word for Windows 2.0 in October 1991.

I used it through engineering coursework in ankara. Before LaTeX became the default for anything math-heavy, the equation editor was where formulas went. Opening the dialog produced a row of buttons for brackets and operators, and you clicked your way to a square root or a summation. The result dropped into the document as an embedded OLE object. Nothing about its UI changed for fifteen years. The Office 2007 ribbon added a native equation tool with proper unicode math, but Microsoft kept the old binary in the install so legacy documents would still render.

The exit was unusual. In November 2017 researchers from Check Point disclosed CVE-2017-11882, a stack overflow in the equation editor that let any malicious.doc run arbitrary code on open. Microsoft patched it that month. Then in January 2018 the same code path produced CVE-2018-0802, again a stack overflow in font parsing, and this time Microsoft skipped the patch. On January 9, 2018 the Patch Tuesday update silently removed the eqnedt32.exe binary from every supported Office install. The editor was twenty seven years old, and nobody on the team could safely repair code Microsoft no longer had a license relationship for.

~ the rap sheet ~

~ the OLE moment ~

Equation Editor 3.0 was a perfect artifact of the early-90s Microsoft idea that everything in Office should be an embeddable object. Excel charts and Word tables worked the same way as the equation dialog. Each one was just another OLE server hosted inside the parent app. You double-clicked an equation and Word's menu bar transformed in place into the equation editor's menu bar, an in-process server takeover that looks faintly miraculous on modern Office where everything is sandboxed.

~ what really happened ~

The original Design Science developer had left long before 2018. The source code, if it still existed, sat in a repository Microsoft did not own, compiled with a toolchain nobody on the Office team had touched in a decade. Microsoft could fix the symptom by patching the parser, or it could remove the program entirely. After the second active exploit in three months the call was easy. The Office team shipped the removal patch as KB 4011604 and let the eqnedt32.exe file disappear from disk.

~ the funny part ~

Within days a small company called 0patch published an unofficial micropatch that fixed the parser without removing the editor, keeping the tool alive for anyone who needed the old equations to render properly. The micropatch was small and the bug well understood. Microsoft had simply decided the binary was not worth the institutional energy of a real fix, particularly for twenty seven year old code from a vendor they no longer worked with.

~ what survived ~

Open any thesis or assignment from a 1995-to-2010 engineering program and the equations were probably rendered by eqnedt32.exe. Twenty seven years of mathematical notation in word documents flowed through one binary that nobody really maintained, on an OLE plumbing layer that nobody seriously defends today. When the binary went away in January 2018 the embedded equations in old documents stayed visible as static images, frozen at the resolution they were rendered into at insert time, which is the closest the equation editor ever got to a tombstone.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »