CVE-2020-16957
<p>A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
<p>A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.</p> <p>An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.</p> <p>The update addresses the vulnerability by correcting the way the Microsoft Office Access Connectivity Engine handles objects in memory.</p>
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 3.87% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/365 apps · microsoft/office
- Source
- secure@microsoft.com
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16957Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16957Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.