cbcvebase.
CVE-2020-0650
published 2020-01-14

CVE-2020-0650: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel…

PriorityP182high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
ITWVulnCheck KEVRansomware
Exploited in the wild
EPSS
17.17%
96.7th percentile
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0651, CVE-2020-0653.

Affected

16 ranges
VendorProductVersion rangeFixed in
microsoftexcel
microsoftexcel
microsoftexcel
microsoftexcel
microsoftoffice_365_proplus
microsoftoffice_365_proplus
msrcmicrosoft_excel_2010_service_pack_2
msrcmicrosoft_excel_2013_rt_service_pack_1
msrcmicrosoft_excel_2013_service_pack_1
msrcmicrosoft_excel_2016
msrcmicrosoft_office_2016_for_mac
msrcmicrosoft_office_2019_for_32-bit_editions
msrcmicrosoft_office_2019_for_64-bit_editions
msrcmicrosoft_office_2019_for_mac
msrcoffice_365_proplus_for_32-bit_systems
msrcoffice_365_proplus_for_64-bit_systems

Detection & IOCsextracted from sources · hover to see the quote

  • Attack vector requires a user to open a specially crafted Microsoft Excel file; the Preview Pane is NOT an attack vector, so malicious file must be explicitly opened.
  • In email-based delivery, attacker sends a specially crafted Excel file as an attachment and socially engineers the recipient into opening it.
  • In web-based delivery, attacker hosts or compromises a website serving a specially crafted Excel file; no drive-by — user must click a link and then open the file.
  • Preview Pane is confirmed NOT an attack vector; detections should focus on file-open events in Excel rather than preview/thumbnail rendering.
  • ·CVE-2020-0650 is distinct from the related Excel RCE CVEs CVE-2020-0651 and CVE-2020-0653; ensure detections and patches target the correct CVE ID.
  • ·Exploitation is rated 'Less Likely' for both latest and older software releases; no public exploit or in-the-wild exploitation confirmed at time of advisory.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.