CVE-2020-0901: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-0901) was identified in Microsoft Excel software, discovered in late 2019 and publicly disclosed on May 12, 2020. The vulnerability affects multiple versions of Microsoft Office and Microsoft 365 Apps, including Office 2010 SP2, Office 2013 SP1, Office 2016, and Office 2019 across various platforms (NVD).

The vulnerability stems from Microsoft Excel's improper handling of objects in memory. It has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. The critical CVSS score indicates that successful exploitation could lead to complete system compromise, potentially affecting the confidentiality, integrity, and availability of the targeted system (NVD).

The vulnerability is considered to have low attack complexity and requires no privileges or user interaction for exploitation, as indicated by the CVSS vector string. The network vector (AV:N) suggests that the vulnerability can be exploited remotely (NVD).

Microsoft released security update 4484338 for affected versions of Excel to address this vulnerability. The patch is available through Microsoft Update, Microsoft Update Catalog, and as standalone packages for both 32-bit and 64-bit versions of Excel 2016 (Microsoft Support).