Remote Code Execution Flaw in Microsoft Word for Android
CVE-2020-1223

8.8HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Word For Android
Vendor
CVE Published:
9 June 2020

Summary

A remote code execution vulnerability exists in Microsoft Word for Android due to improper handling of specially crafted URL files. An attacker could exploit this by persuading a user to open such a maliciously constructed file, leading to the unauthorized execution of code. Microsoft has addressed this vulnerability by improving the handling processes of these URL files, thereby enhancing the security of the application.

Affected Version(s)

Microsoft Word for Android = unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.