CVE-2020-17126: 
vulnerability analysis and mitigation

Microsoft Excel Information Disclosure Vulnerability (CVE-2020-17126) is a security flaw that affects various Microsoft Excel and Office products. The vulnerability was disclosed on December 8, 2020, and impacts multiple versions including Excel 2010 SP2, Excel 2013 SP1, Excel 2016, Microsoft 365 Apps Enterprise, Office 2019, Office Online Server, and Office Web Apps 2013 SP1 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction, while potentially resulting in high confidentiality impact but no effects on integrity or availability (NVD).

This vulnerability could allow information disclosure if a user opens a specially crafted Office file. The attack specifically targets the confidentiality of information, with potential exposure of sensitive data (Microsoft Support).

Microsoft has released security updates to address this vulnerability. The fixes are available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center. For Office Online Server, users can apply security update 4486750, and for Excel 2010, security update 4493148 is available for both 32-bit and 64-bit versions (Microsoft Support).