CVE-2020-1502
📋 TL;DR
This is an information disclosure vulnerability in Microsoft Word where specially crafted documents can leak memory contents when opened. Attackers could potentially use leaked information to further compromise systems. All users running vulnerable versions of Microsoft Word are affected.
💻 Affected Systems
- Microsoft Word
- Microsoft Office
📦 What is this software?
365 Apps by Microsoft
Office by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Memory contents disclosure could reveal sensitive data, credentials, or system information that enables full system compromise.
Likely Case
Limited information disclosure from Word's memory space, potentially revealing document fragments or system information.
If Mitigated
No impact if patched or if users don't open untrusted documents.
🎯 Exploit Status
Exploitation requires attacker to know specific memory address locations and convince user to open malicious document.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Security updates released in August 2020 (specific KB numbers vary by Office version)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1502
Restart Required: Yes
Instructions:
1. Open Microsoft Office application. 2. Go to File > Account > Update Options > Update Now. 3. Install available updates. 4. Restart computer if prompted.
🔧 Temporary Workarounds
Block Office documents from untrusted sources
windowsConfigure Group Policy or security software to block Word documents from untrusted sources
Use Protected View
windowsEnsure Protected View is enabled for documents from the internet
🧯 If You Can't Patch
- Implement application whitelisting to restrict which documents can be opened
- Train users to never open documents from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Office version against Microsoft's security update list for August 2020Check Version:
In Word: File > Account > About Word (shows version)Verify Fix Applied:
Verify Office version is updated to post-August 2020 security updates📡 Detection & Monitoring
Log Indicators:
- Multiple Word crashes from same document
- Unusual document opening patterns
Network Indicators:
- Downloads of suspicious Office documents
SIEM Query:
Office process memory access anomalies or document opening from untrusted sources