CVE-2020-1498: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1498) exists in Microsoft Excel software when the software fails to properly handle objects in memory. This vulnerability affects multiple versions of Microsoft Excel including Excel 2010, Excel 2013, Excel 2016, and Microsoft 365 Apps (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 Base Score is 9.3 (HIGH) with the vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

An attacker who successfully exploits this vulnerability could run arbitrary code in the context of the current user. If the current user has administrative privileges, the attacker could take control of the affected system, install programs, view or modify data, or create new accounts with full user rights. Users with fewer system privileges may be less impacted than those with administrative rights (NVD).

Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Excel. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing them to open it. In a web-based attack scenario, an attacker could host a website containing the malicious file and would need to convince users to visit the website and open the file (NVD).

Microsoft addressed this vulnerability by releasing security updates that correct how Microsoft Excel handles objects in memory. The updates were released on August 11, 2020, and are available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center (Microsoft Support).