CVE-2020-1497: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-1497) was identified in Microsoft Excel that improperly discloses the contents of its memory. The vulnerability was discovered and assigned on November 4, 2019, and was publicly disclosed with patches released on August 11, 2020. This vulnerability affects multiple versions of Microsoft Excel and Microsoft Office, including Excel 2010 SP2, Excel 2013 SP1, Excel 2016, and Microsoft 365 Apps Enterprise (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability requires user interaction and local access, but no privileges are needed for exploitation. The confidentiality impact is rated as high, while there are no integrity or availability impacts (NVD).

If successfully exploited, an attacker could use the disclosed memory contents to compromise the user's computer or data. The vulnerability specifically affects the way Excel handles objects in memory, potentially exposing sensitive information to attackers (NVD).

To exploit this vulnerability, an attacker must craft a special document file and convince the user to open it. Additionally, the attacker must know the memory address location where the object was created, which increases the complexity of exploitation (NVD).

Microsoft has released security updates that address this vulnerability by changing the way certain Excel functions handle objects in memory. The fix was included in the August 11, 2020 security updates for affected versions of Microsoft Excel and Office (Microsoft Support).