CVE-2020-1224
📋 TL;DR
This is a memory information disclosure vulnerability in Microsoft Excel where specially crafted documents can leak memory contents. Attackers could use leaked information to compromise systems or data. Users who open malicious Excel files are affected.
💻 Affected Systems
- Microsoft Excel
📦 What is this software?
365 Apps by Microsoft
Excel by Microsoft
Excel by Microsoft
Excel by Microsoft
Excel by Microsoft
Office by Microsoft
Office by Microsoft
Office by Microsoft
Office Web Apps by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Memory contents disclosure leads to credential theft, privilege escalation, or full system compromise through follow-on attacks.
Likely Case
Information disclosure that could reveal sensitive data or system information useful for targeted attacks.
If Mitigated
Limited impact with proper email filtering, user training, and application sandboxing.
🎯 Exploit Status
Requires attacker to know specific memory address locations and social engineering to deliver file
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Microsoft security update from May 2020
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1224
Restart Required: Yes
Instructions:
1. Open Windows Update settings. 2. Check for updates. 3. Install May 2020 security updates for Office/Excel. 4. Restart computer if prompted.
🔧 Temporary Workarounds
Disable Excel file opening
windowsBlock Excel files from untrusted sources via group policy or application control
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized Excel execution
- Use email filtering to block suspicious Excel attachments
🔍 How to Verify
Check if Vulnerable:
Check Excel version and compare to patched versions from May 2020 security updatesCheck Version:
In Excel: File > Account > About ExcelVerify Fix Applied:
Verify Windows Update history shows May 2020 Office security updates installed📡 Detection & Monitoring
Log Indicators:
- Excel crash logs, unexpected Excel process launches from email attachments
Network Indicators:
- Excel files downloaded from suspicious sources
SIEM Query:
Process creation where parent process is email client and child process is excel.exe