CVE-2020-16918: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-16918) was discovered in the Base3D rendering engine, identified in October 2020. The vulnerability affects Microsoft 365 Apps Enterprise and Microsoft 3D Viewer applications. The issue stems from improper memory handling in the Base3D rendering engine (NVD, CVE).

The vulnerability is characterized by improper memory handling in the Base3D rendering engine. It has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access is required with user interaction. The CVSS v2.0 score is 9.3 with vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

If successfully exploited, this vulnerability would allow an attacker to gain execution privileges on a victim system, potentially leading to complete system compromise with the ability to execute arbitrary code (Rapid7).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a user to interact with a specially crafted file or application that leverages the Base3D rendering engine (NVD).

Microsoft has released a security update that addresses the vulnerability by correcting how the Base3D rendering engine handles memory. Users are advised to update to the latest version of affected software through Microsoft Store or system updates. For systems without Microsoft Store access, upgrading the Windows OS to version 2004 or 20H2 can provide the updated version of 3D Viewer (Microsoft).