CVE-2020-16855
📋 TL;DR
This CVE describes an information disclosure vulnerability in Microsoft Office where uninitialized memory could be read when opening specially crafted files. Attackers could exploit this to view out-of-bounds memory contents. Users who open malicious Office files with affected versions are at risk.
💻 Affected Systems
- Microsoft Office
📦 What is this software?
Office by Microsoft
Office by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Sensitive memory contents including credentials, encryption keys, or other application data could be leaked to an attacker.
Likely Case
Limited information disclosure from Office application memory, potentially revealing document fragments or application state.
If Mitigated
No impact if users don't open untrusted Office files or have patched systems.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of file format manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Available through Microsoft's October 2020 security updates
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16855
Restart Required: Yes
Instructions:
1. Apply Microsoft's October 2020 security updates for Office. 2. Restart affected systems. 3. Verify Office version is updated.
🔧 Temporary Workarounds
Block Office file types via email filtering
allPrevent delivery of potentially malicious Office files via email
Use Office Protected View
windowsConfigure Office to open untrusted files in Protected View mode
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized Office file execution
- Train users to avoid opening Office files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Office version against Microsoft's advisory for affected versionsCheck Version:
In Office: File > Account > About [Application]Verify Fix Applied:
Verify Office has October 2020 or later security updates installed📡 Detection & Monitoring
Log Indicators:
- Office application crashes with memory access violations
- Unusual Office file openings from email attachments
Network Indicators:
- N/A - local exploitation only
SIEM Query:
Office application crash events with memory exception codes