CVE-2020-1504: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1504) exists in Microsoft Excel software when the software fails to properly handle objects in memory. The vulnerability was discovered and reported to Microsoft in November 2019, with the security update being released on August 11, 2020. This vulnerability affects various versions of Microsoft Excel and Microsoft Office (CVE MITRE).

The vulnerability stems from Microsoft Excel's improper handling of objects in memory. When successfully exploited, it allows attackers to execute arbitrary code in the context of the current user. The severity of the impact increases significantly if the user has administrative privileges on the system (CVE MITRE).

If successfully exploited, an attacker could gain the ability to run arbitrary code with the same privileges as the current user. For users with administrative rights, this could lead to complete system compromise, allowing attackers to install programs, view, change, or delete data, and create new accounts with full user rights. Users with limited privileges would face less severe impacts (CVE MITRE).

Exploitation requires a user to open a specially crafted Excel file. Attackers can deliver this file through email attachments or by hosting it on a malicious or compromised website. The attacker must convince users to open the malicious file, typically through social engineering tactics in emails or instant messages (CVE MITRE).

Microsoft has released security updates that address this vulnerability by correcting how Microsoft Excel handles objects in memory. The update is available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center. For Excel 2010, users must have Service Pack 2 installed before applying the security update (Microsoft Support).