Security Features in Microsoft Office and Microsoft Outlook - CVE-2020-0696

Detailed vulnerability description

This vulnerability allows a local attacker to bypass security rescritions feature.

The vulnerability exists due to the Microsoft Outlook software improperly handles the parsing of URI formats. A remote attacker can trick a victim to open a specially crafted URI and execute target application.

The security feature bypass by itself does not allow arbitrary code execution. However, to successfully exploit the vulnerability, an attacker would have to use it in conjunction with another vulnerability, such as a remote code execution vulnerability.

How to mitigate CVE-2020-0696

Sources

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0696