CVE-2020-13545
📋 TL;DR
This vulnerability allows remote code execution through a heap-based buffer overflow when parsing malicious TextMaker documents in SoftMaker Office 2021. Attackers can exploit this by tricking users into opening specially crafted documents, potentially gaining control of the affected system. Users of SoftMaker Office 2021 TextMaker application are affected.
💻 Affected Systems
- SoftMaker Office 2021 TextMaker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the victim's computer, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Arbitrary code execution with the privileges of the user opening the document, leading to data exfiltration, credential theft, or lateral movement within the network.
If Mitigated
Application crash or denial of service if exploit fails or memory protections prevent full code execution.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious document but no authentication. The vulnerability is well-documented with technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SoftMaker Office 2021 with security update addressing CVE-2020-13545
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1162
Restart Required: Yes
Instructions:
1. Open SoftMaker Office 2021. 2. Navigate to Help > Check for Updates. 3. Install all available updates. 4. Restart the application. 5. Verify the patch is applied by checking version information.
🔧 Temporary Workarounds
Disable document preview and auto-open
allPrevent automatic parsing of documents by disabling preview features and requiring explicit user action to open files.
Use application sandboxing
allRun TextMaker in a sandboxed environment to limit potential damage from exploitation.
🧯 If You Can't Patch
- Block TextMaker document files (.tmd, .tmv) at network perimeter and email gateways
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check SoftMaker Office version in Help > About. If version is 2021 without the security patch, the system is vulnerable.Check Version:
On Windows: Check Help > About in TextMaker. On Linux/macOS: Check application properties or about dialog.Verify Fix Applied:
Verify the application version shows the patched version and test with known safe documents to ensure normal functionality.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected process termination of TextMaker
- Unusual document parsing errors
Network Indicators:
- Downloads of TextMaker documents from untrusted sources
- Email attachments with .tmd/.tmv extensions
SIEM Query:
Process:TextMaker.exe AND (EventID:1000 OR ExceptionCode:c0000005) OR FileExtension:(.tmd OR .tmv) AND SourceIP:(external_network)