Microsoft Word Information Disclosure Vulnerability
Priority MEDIUM 48Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created. The update addresses the vulnerability by changing the way certain Word functions handle objects in memory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04906 92nd percentileScored 2026-11-07
Fix Fixed Microsoft SharePoint Enterprise Server 2016 (Microsoft): publicationMicrosoft SharePoint Enterprise Server 2013 Service Pack 1 (Microsoft): publication+13 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Enterprise Server 2013 Service Pack 1 | 15.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2019 | 19.0.0 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Office 2019 for Mac | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Online Server | 16.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Word 2016 | 16.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2016 for Mac | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Web Apps 2010 Service Pack 2 | 13.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Web Apps 2013 Service Pack 1 | 15.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2013 Service Pack 1 | 15.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2013 Service Pack 1 | 15.0.1 to before publication | publication | Patch available | CNA |
- Microsoft SharePoint Enterprise Server 2016 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Enterprise Server 2013 Service Pack 1 VendorMicrosoft Affected 15.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Server 2019 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Office 2019 for Mac VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Online Server VendorMicrosoft Affected 16.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft 365 Apps for Enterprise VendorMicrosoft Affected 16.0.1 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Word 2016 VendorMicrosoft Affected 16.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2016 for Mac VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Web Apps 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Web Apps 2013 Service Pack 1 VendorMicrosoft Affected 15.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Server 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2013 Service Pack 1 VendorMicrosoft Affected 15.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2013 Service Pack 1 VendorMicrosoft Affected 15.0.1 to before publication Fixed in publication Patch available CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2016:*:*:*:*:macos:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:macos:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
Remediation
- Fix · CNA Microsoft SharePoint Enterprise Server 2016 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Enterprise Server 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Server 2019 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2019 (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
- Fix · CNA Microsoft Office 2019 for Mac (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Online Server (Microsoft) Fixed in publication
- Fix · CNA Microsoft 365 Apps for Enterprise (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
- Fix · CNA Microsoft Word 2016 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2016 for Mac (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Web Apps 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Web Apps 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Server 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2013 Service Pack 1 (Microsoft) Fixed in publication
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1583
- 2026-10-03 Alias added: GHSA-97j9-x88r-5g6v
More Microsoft 365 Apps vulnerabilities
- TI-2024-14173 Microsoft Outlook Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-25471 Microsoft Project Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2026-17368 Microsoft Word Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2026-17363 Microsoft Office Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2020-1583 · CVE Program
- CVE-2020-1583 · NVD
- FIRST EPSS
- GHSA-97j9-x88r-5g6v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences