cbcvebase.
CVE-2020-0901
published 2020-05-21

CVE-2020-0901: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel…

PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
11.56%
95.6th percentile
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftmicrosoft_365_apps_for_enterprise_for_32-bit_systems
microsoftmicrosoft_365_apps_for_enterprise_for_64-bit_systems
microsoftmicrosoft_excel
microsoftmicrosoft_excel
microsoftmicrosoft_excel
microsoftmicrosoft_excel
microsoftmicrosoft_excel
microsoftmicrosoft_excel
microsoftmicrosoft_excel
microsoftmicrosoft_office
microsoftmicrosoft_office
microsoftmicrosoft_office
microsoftmicrosoft_office
microsoftoffice
microsoftoffice
microsoftoffice
microsoftoffice
msrcmicrosoft_365_apps_for_enterprise_for_32-bit_systems
msrcmicrosoft_365_apps_for_enterprise_for_64-bit_systems
msrcmicrosoft_excel_2010_service_pack_2
msrcmicrosoft_excel_2013_rt_service_pack_1
msrcmicrosoft_excel_2013_service_pack_1
msrcmicrosoft_excel_2016
msrcmicrosoft_office_2016_for_mac
msrcmicrosoft_office_2019_for_32-bit_editions

Detection & IOCsextracted from sources · hover to see the quote

snort
53268
snort
53269
  • Trigger is opening a specially crafted malformed Excel file exploiting the s_Schema functionality via a use-after-free condition; detection should focus on malformed Excel files delivered via email or web.
  • The Preview Pane is NOT an attack vector; exploitation requires the user to fully open the crafted Excel file.
  • Vulnerable component is the Excel s_Schema functionality; focus memory/heap analysis on use-after-free in s_Schema code paths.
  • ·Snort rules 53268 and 53269 are subject to change as additional vulnerability information becomes available; always reference the latest rules from Firepower Management Center or Snort.org.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_msrc9.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.