CVE-2020-1224
MEDIUMMicrosoft Excel - Information Disclosure via Memory Handling
Title source: llmDescription
<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data.</p> <p>To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created.</p> <p>The update addresses the vulnerability by changing the way certain Excel functions handle objects in memory.</p>
References (1)
Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1224
Scores
CVSS v3
5.5
EPSS
0.0435
EPSS Percentile
90.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
Status
published
Products (9)
microsoft/365_apps
microsoft/excel
2010 sp2
microsoft/excel
2013 sp1 (2 CPE variants)
microsoft/excel
2016
microsoft/office
2016
microsoft/office
2019 (2 CPE variants)
microsoft/office_online_server
microsoft/office_web_apps
2013 sp1
microsoft/sharepoint_enterprise_server
2013 sp1
Published
Sep 11, 2020
Tracked Since
Feb 18, 2026