Read the docs
TI-2020-01539 Aliases CVE-2020-1581GHSA-wpjv-j566-pfwc

Microsoft Office Click-to-Run Elevation of Privilege Vulnerability

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the system. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The security update addresses the vulnerability by correcting how Microsoft Office Click-to-Run (C2R) components handle objects in memory.

Why it matters now

EPSS 0.03717 89th percentileScored 2026-11-07
Fix Fixed Microsoft Office 2013 Click-to-Run (C2R) (Microsoft): 15.0.5571.1000Microsoft Office 2019 (Microsoft): https://aka.ms/OfficeSecurityReleases+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Office 2013 Click-to-Run (C2R)15.0.0.0 to before 15.0.5571.100015.0.5571.1000Patch availableCNA
MicrosoftMicrosoft Office 201919.0.0 to before https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleasesPatch availableCNA
MicrosoftMicrosoft 365 Apps for Enterprise16.0.1 to before https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleasesPatch availableCNA
  • Microsoft Office 2013 Click-to-Run (C2R) VendorMicrosoft Affected 15.0.0.0 to before 15.0.5571.1000 Fixed in 15.0.5571.1000 Patch available CNA
  • Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
  • Microsoft 365 Apps for Enterprise VendorMicrosoft Affected 16.0.1 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:office:2013:*:*:*:click-to-run:*:*:*2013VulnerableMicrosoft
cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*2019VulnerableMicrosoft
  • cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:office:2013:*:*:*:click-to-run:*:*:* Versions 2013 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:* Versions 2019 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Office 2013 Click-to-Run (C2R) (Microsoft) Fixed in 15.0.5571.1000
  • Fix · CNA Microsoft Office 2019 (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
  • Fix · CNA Microsoft 365 Apps for Enterprise (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1581
  2. 2026-10-03 Alias added: GHSA-wpjv-j566-pfwc

References

Patch 1

  • TI-2024-14173 Microsoft Outlook Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25471 Microsoft Project Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2026-17368 Microsoft Word Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
  • TI-2026-17363 Microsoft Office Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
See all 935 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences