CVE-2020-0922: Microsoft COM for Windows Remote Code Execution Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2020-Sep
Released
2020-09-08
EPSS Score
17.73% (percentile: 95.1%)

Description

A remote code execution vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system. To exploit the vulnerability, a user would have to open a specially crafted file or lure the target to a website hosting malicious JavaScript. The security update addresses the vulnerability by correcting how Microsoft COM for Windows handles objects in memory.

Affected Products (44)

Other

  • 11497
  • 11498
  • 11563
  • 11568
  • 11569
  • 11570
  • 11571
  • 11572
  • 11712
  • 11713
  • 11714
  • 11715
  • 11453
  • 11454
  • 11583
  • 11644
  • 11645
  • 11646
  • 11647
  • 11766
  • 11767
  • 11768
  • 11769
  • 10729
  • 10735
  • 10852
  • 10853
  • 10816
  • 10855
  • 10047
  • 10048
  • 10481
  • 10482
  • 10484
  • 9312
  • 10287
  • 9318
  • 9344
  • 10051
  • 10049
  • 10378
  • 10379
  • 10483
  • 10543

Security Updates (15)

Acknowledgments

Yuki Chen

Revision History

  • 2020-09-08: Information published.