CVE-2020-1447: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1447) exists in Microsoft Word software when it fails to properly handle objects in memory. This vulnerability was disclosed on July 14, 2020, affecting various versions of Microsoft Word and Microsoft Office products including Office 2010, 2016, 2019, and Microsoft 365 Apps (NVD, Microsoft Support).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a base score of 6.8 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:P/I:P/A:P). The vulnerability requires user interaction and can be exploited remotely (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. If the current user has administrative privileges, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights (NVD).

The vulnerability requires user interaction, specifically opening a specially crafted Microsoft Office file. The attack can be conducted remotely with no privileges required, though it does require convincing a user to open a malicious file (NVD).

Microsoft released security updates to address this vulnerability as part of its July 2020 Patch Tuesday updates. Users are advised to install security update 4484438 for affected versions of Microsoft Word. For Word 2016, both 32-bit and 64-bit versions have specific update packages available (Microsoft Support).