CVE-2020-0850: Microsoft Word Remote Code Execution Vulnerability
CVE-2020-0850 is a remote code execution vulnerability in Microsoft Word, rated Important by Microsoft. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 8.82% probability of exploitation activity in the next 30 days, higher than 95% of all scored vulnerabilities. Microsoft released the fix on 10 March 2020 in the March 2020 Patch Tuesday, delivered through 9 security updates (KB4484272, KB4484275, KB4475606, KB4484271 and more). It affects 16 products in 1 product family (Microsoft Office).
Key facts
- CVE ID
- CVE-2020-0850
- Severity
- N/A
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- EPSS
- 8.82% (percentile 95%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- March 2020 Patch Tuesday
- Product families
- Microsoft Office
Description
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.
To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Word software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.
The security update addresses the vulnerability by correcting how Microsoft Word handles files in memory.
Frequently asked questions (Microsoft)
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Affected products (16)
Microsoft Office
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft SharePoint Enterprise Server 2016 | KB4484272 KB4484275 | Security Update Security Update | Maybe Maybe | |
| Microsoft SharePoint Enterprise Server 2013 Service Pack 1 | KB4475606 | Security Update | Maybe | |
| Microsoft SharePoint Server 2019 | KB4484271 KB4484277 | Security Update Security Update | Maybe Maybe | |
| Microsoft Office 2019 for 32-bit editions | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Microsoft Office 2019 for 64-bit editions | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Microsoft Office 2019 for Mac | Release Notes | Security Update | No | |
| Office 365 ProPlus for 32-bit Systems | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Office 365 ProPlus for 64-bit Systems | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Microsoft Office Online Server | KB4484270 | Security Update | Maybe | |
| Microsoft Word 2016 (32-bit edition) | KB4484268 | Security Update | Maybe | |
| Microsoft Word 2016 (64-bit edition) | KB4484268 | Security Update | Maybe | |
| Microsoft Office 2016 for Mac | Release Notes | Security Update | No | |
| Microsoft Word 2013 RT Service Pack 1 | KB4484231 | Security Update | Maybe | |
| Microsoft Word 2013 Service Pack 1 (32-bit editions) | KB4484231 | Security Update | Maybe | |
| Microsoft Word 2013 Service Pack 1 (64-bit editions) | KB4484231 | Security Update | Maybe | |
| Microsoft SharePoint Foundation 2013 Service Pack 1 | KB4484124 | Security Update | Maybe |
Security updates (9)
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 8.8 (HIGH)
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| office 2016 | all listed versions |
| office 2019 | all listed versions |
| office 2019 | all listed versions |
| office 365 proplus | all listed versions |
| office online server 1.0 | all listed versions |
| sharepoint enterprise server 2013 | all listed versions |
| sharepoint enterprise server 2016 | all listed versions |
| sharepoint foundation 2013 | all listed versions |
| sharepoint server 2019 | all listed versions |
| word 2013 | all listed versions |
| word 2013 | all listed versions |
| word 2016 | all listed versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0850 (Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0850 (Patch, Vendor Advisory)
Acknowledgments
- Haifei Li of McAfee IPS Security Research Team
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |