What happened
Microsoft describes CVE-2020-0901 as a remote code execution vulnerability caused by Excel handling objects in memory incorrectly [S1]. Successful exploitation could run code with the current user's permissions, with greater impact when that user had administrative rights [S1].
The attack required the target to open a specially crafted file in an affected Excel release [S1]. Microsoft described both email delivery and websites hosting the file, but in either case the attacker still had to convince the user to open it [S1].
Affected products
Microsoft lists Microsoft 365 Apps for Enterprise, Excel 2010 Service Pack 2, Excel 2013 Service Pack 1, Excel 2016, Office 2016 for Mac, and Office 2019 for Windows and Mac among the affected product families [S1]. NVD scores the issue 9.8 Critical and does not assign a specific CWE [S2].
Microsoft says the security update corrected how Excel handles objects in memory [S1]. Administrators should use Microsoft's update guidance for the exact Office product and servicing channel rather than applying a generic version rule [S1].
Why FixVibe will not check this automatically
A web or repository scan cannot determine the installed desktop Excel build and patch level on each person who may download a spreadsheet. The presence of spreadsheet-processing code, an upload endpoint, or an Office document in a repository does not establish that vulnerable Microsoft Excel software will open that file [S1][S2].
FixVibe will not open an untrusted workbook in a vulnerable Excel process to test the condition. That would cross the read-only scan boundary and could execute attacker-controlled code on the scanning host.
Remediation
Apply Microsoft's current security updates to every affected Office installation [S1]. Avoid opening unexpected Office attachments or downloads, and run daily work without administrative privileges to limit the impact described by Microsoft [S1].
For applications that accept spreadsheets, keep server-side parsers and converters updated as a separate dependency-management task. Their presence is not evidence of CVE-2020-0901, which applies to Microsoft Excel [S1].