CVE-2020-1218: 
vulnerability analysis and mitigation

CVE-2020-1218 is a remote code execution vulnerability that exists in Microsoft Word if the software does not correctly handle objects in memory. The vulnerability was disclosed and patched on September 8, 2020, affecting Microsoft Word 2013 and SharePoint Server 2010 Office Web Apps (Microsoft Word Update, SharePoint Update).

The vulnerability exists in Microsoft Word's memory handling functionality. When the software fails to properly handle objects in memory, it creates a condition that could allow remote code execution. Security updates were released to address this by correcting how Microsoft Word handles objects in memory (Microsoft Word Update).

If successfully exploited, an attacker could execute arbitrary code in the context of the current user. If the current user has administrative privileges, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights (Microsoft Word Update).

Microsoft has released security updates to address this vulnerability. Users should apply the security update KB4484522 for Word 2013 or KB4486661 for SharePoint Server 2010 Office Web Apps. The updates can be obtained through Microsoft Update, Microsoft Update Catalog, or Microsoft Download Center (Microsoft Word Update, SharePoint Update).