CVE-2020-1224

medium Microsoft
CVSS v3 Base Score
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
25.0%
Exploitation probability in 30 days
Top 4% most likely to be exploited
Attack Characteristics
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Published: September 11, 2020 (2071 days ago)
Last Modified: February 23, 2026
Vendor: Microsoft

Description

<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data.</p> <p>To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created.</p> <p>The update addresses the vulnerability by changing the way certain Excel functions handle objects in memory.</p>

CWE

NVD-CWE-noinfo

Affected Products

microsoft 365 appsmicrosoft excelmicrosoft officemicrosoft office online servermicrosoft office web appsmicrosoft sharepoint enterprise server

References

🔗 portal.msrc.microsoft.com 🔗 portal.msrc.microsoft.com