CVE-2020-16947

CWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds Write4 documents4 sources
Severity
8.8HIGH
EPSS
45.4%
top 2.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Microsoft Microsoft 365 Apps FOR EnterpriseMicrosoft Microsoft Office 2019Microsoft Microsoft Outlook 2016+2 more
Timeline
PublishedOct 16
Latest updateMay 24

Description

A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the targeted user. If the targeted user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5microsoft/microsoft_outlook_201616.0.0.0 — publication
▶CVEListV5microsoft/microsoft_office_201919.0.0 — https://aka.ms/OfficeSecurityReleases
▶CVEListV5microsoft/microsoft_365_apps_for_enterprise16.0.1 — https://aka.ms/OfficeSecurityReleases

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-5wr3-pfv7-cqv6: A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory, aka 'Microsof↗2022-05-24
▶
CVEList
Microsoft Outlook Remote Code Execution Vulnerability↗2020-10-16
▶

📋Vendor Advisories

1
Microsoft
Microsoft Outlook Remote Code Execution Vulnerability↗2020-10-13
▶