CVE-2020-1557: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1557) exists in the Windows Jet Database Engine when it improperly handles objects in memory. The vulnerability was disclosed on August 11, 2020, and affects various versions of Microsoft Windows operating systems. This vulnerability is also known as 'Jet Database Engine Remote Code Execution Vulnerability' and is distinct from related vulnerabilities CVE-2020-1473, CVE-2020-1558, and CVE-2020-1564 (NVD).

The vulnerability has received a CVSS v3.1 base score of 7.8 (High) from NVD with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, while Microsoft assigned it a slightly lower score of 7.3 with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a base score of 9.3 (High) with vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

An attacker who successfully exploits this vulnerability could execute arbitrary code on a victim system, potentially gaining the same privileges as the compromised user. The vulnerability affects the confidentiality, integrity, and availability of the system with high severity ratings across all three aspects (NVD).

The vulnerability can be exploited by enticing a victim to open a specially crafted file. The attack requires user interaction and local access to the system. No evidence of active exploitation in the wild has been publicly reported (NVD).

Microsoft has released security updates to address this vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. The fix is available through various KB updates depending on the Windows version, including KB4571694, KB4571741, KB4565349, and others (Rapid7).