CVE-2020-1503: microsoft 365_apps
Vulnerability summary
CVE-2020-1503 is a medium (CVSS 5.5) vulnerability in microsoft 365_apps. EPSS estimates a 4.55% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities.
Timeline
- 17-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created. The update addresses the vulnerability by changing the way certain Word functions handle objects in memory.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
4.55%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.55% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft22 products
- 365_appsna
- microsoft 365 apps for enterprise≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases
- microsoft office 2010 service pack 2≥ 13.0.0.0, < publication
- microsoft office 2016 for mac≥ 16.0.0, < publication
- microsoft office 2019≥ 19.0.0, < https://aka.ms/OfficeSecurityReleases
1 vendor · 22 products
References
1 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1503X Refsource MISCPatchVendor Advisory