CVE-2020-0652

HIGH EXPLOITED RANSOMWARE

Microsoft Excel - Remote Code Execution via Memory Corruption

Title source: llm

Exploitation Summary

CVE-2020-0652 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns.

Description

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0652

Third Party Advisory, VDB Entry x_refsource_misc

https://www.zerodayinitiative.com/advisories/ZDI-20-127/

Scores

CVSS v3 7.8

EPSS 0.1696

EPSS Percentile 96.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2020-01-22

Ransomware Use Confirmed

CWE

CWE-787

Status published

Products (5)

microsoft/excel 2010 sp2

microsoft/excel 2013 sp1 (2 CPE variants)

microsoft/excel 2016

microsoft/excel 2019

microsoft/office_365_proplus

Published Jan 14, 2020

Tracked Since Feb 18, 2026