Vulnerability Spotlight: Two code execution vulnerabilities in Microsoft Excel
Summary: Cisco Talos researchers discovered two code execution vulnerabilities in Microsoft Excel, both tied to the component that handles Microsoft Office HTML and XML file types, and Microsoft released updates for them in this week's Patch Tuesday. One is a use-after-free bug in Office Professional Plus 2016 x86 (version 2002, build 12527.20242) and Office 365 ProPlus x86 (version 1908, build 11929.20606) that a crafted XLS file can trigger, and the other is an HTML and XML table code execution flaw (TALOS-2020-1045/CVE-2020-1225) in the same builds.
What you should know: Both bugs require only that a victim open a malformed Excel file, so a single attachment is enough to hand an attacker code execution on the machine.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-1225
- Related
- Microsoft Patch Tuesday, June 2020 Edition Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026