CVE-2020-0901

CVE-2020-0901

Critical · published May 22, 2020

CVSS v3.1
9.8
EPSS
4%
Percentile
91.4
In the wild
Unconfirmed
What it is

⚠️ A crafty bug in Microsoft Excel could let attackers execute code remotely, like an uninvited guest slipping in through a poorly secured back door! 🔥 Imagine a dinner party where someone sneaks in without an invitation, then starts messing with the host's recipe book. This vulnerability lets an attacker manipulate Excel's memory, allowing undesirable actions to take place without permission. If exploited, this vulnerability could allow an attacker to take control of your system, potentially reading, modifying, or deleting your sensitive data. It's like handing over the keys to your house while you’re out! Fortunately, there's no known exploitation at this time, but being proactive is key.

Put simply

Imagine a dinner party where someone sneaks in without an invitation, then starts messing with the host's recipe book. This vulnerability lets an attacker manipulate Excel's memory, allowing undesirable actions to take place without permission. This remote code execution vulnerability occurs when Microsoft Excel improperly handles objects in memory, allowing attackers to send specially crafted files that can execute arbitrary code on the victim's machine.

What to do

If exploited, this vulnerability could allow an attacker to take control of your system, potentially reading, modifying, or deleting your sensitive data. It's like handing over the keys to your house while you’re out! Fortunately, there's no known exploitation at this time, but being proactive is key. To protect yourself, ensure you're running the latest version of Microsoft Excel. Check for updates regularly to patch any vulnerabilities. It wouldn't hurt to educate your team about safe file handling practices when it comes to opening Excel documents. You've got this! Keep your systems updated and you'll be one step ahead of the bad guys! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04457 · 91.4th percentile
Published
2020-05-22T03:15Z
Affected products (8)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
References (2)
EPSS history
Timeline
  • 21 MAY 22:52Z
    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel…
    cvelistv5