CVE-2020-0852 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Office

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources

Severity

7.8HIGHNVD

CNA8.8

EPSS

33.7%

top 3.05%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Office Microsoft Office Online Server Microsoft Sharepoint Server +3 more

Timeline

PublishedMar 12

Latest updateMay 24

Description

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0855, CVE-2020-0892.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶NVDmicrosoft/office2016, 2019+1

▶CVEListV5microsoft/microsoft_office2016 for Mac, 2019 for 32-bit editions, 2019 for 64-bit editions+2

▶NVDmicrosoft/sharepoint_server2019

▶NVDmicrosoft/office_online_server1.0

▶CVEListV5microsoft/microsoft_sharepoint_server2019

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-grjr-8jcg-fc9w: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote↗2022-05-24

▶

CVEList

CVE-2020-0852: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote↗2020-03-12

▶

📋Vendor Advisories

Microsoft

Microsoft Word Remote Code Execution Vulnerability↗2020-03-10

▶