Vulnerability Spotlight: Code execution vulnerability in Microsoft Excel

Summary: Cisco Talos discovered a code execution vulnerability in Microsoft Excel's s_Schema functionality, where a specially crafted malformed file triggers a use-after-free condition and allows remote code execution. Talos confirmed the flaw affects Microsoft Office 2001 build 12430.20264 and Office 365 ProPlus x86 version 1908 build 11929.20606, and Microsoft patched it as CVE-2020-0901 in its monthly security update.
Bottom line: Exploitation requires only that a victim open a malicious Excel file, so a single document delivered by email or shared link is enough to hand an attacker remote code execution on the machine.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-0901
Related: Microsoft Patch Tuesday — May 2020: Vulnerability disclosures and Snort coverage Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026