CVE-2020-0892: 
vulnerability analysis and mitigation

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, identified as CVE-2020-0892. This vulnerability was disclosed on March 10, 2020, and affects various versions of Microsoft Word, Office Online Server, and related Microsoft Office products (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires user interaction and local access, but can result in high impacts to confidentiality, integrity, and availability. The vulnerability is unique from other similar vulnerabilities discovered at the same time (CVE-2020-0850, CVE-2020-0851, CVE-2020-0852, CVE-2020-0855) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. Users with administrative privileges would be more severely impacted than those with restricted access. The vulnerability could potentially lead to unauthorized access, data manipulation, and system compromise (NVD).

Microsoft has released security updates to address this vulnerability. The patches are available through Microsoft Update, Microsoft Update Catalog, and as standalone packages. For Office Online Server, after installing the security update, it's recommended to change the logging verbosity to Medium using the command 'Set-OfficeWebAppsFarm -LogVerbosity "Medium"' followed by restarting the Office Online Service (Microsoft Support).