CVE-2020-1223

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when Microsoft Word for Android fails to properly handle certain files.To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted URL file.The update addresses the vulnerability by correcting how Microsoft Word for Android handles specially crafted URL files., aka 'Word for Android Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-12245.5<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who explCVE-2020-122427.8Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a difCVE-2020-122437.5In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon CVE-2020-122447.5An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA wCVE-2020-122456.1Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.CVE-2020-122468.8Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, thCVE-2020-122477.1In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds CVE-2020-122488.8In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overCVE-2020-12258.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'CVE-2020-122512.2An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an authenticated user to change the filename value (inCVE-2020-122526.2An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an arbitrary file upload for an authenticated user. IfCVE-2020-122547.8Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink.