TI-2020-12945 Aliases CVE-2020-16957 GHSA-7ch6-cg9m-mgp4

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

MEDIUM 41Published 2020-10-16 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Microsoft Office Access Connectivity Engine handles objects in memory.

Why it matters now

EPSS 0.03871 90th percentileScored 2026-11-07

Fix Fixed Microsoft Office 2019 (Microsoft): https://aka.ms/OfficeSecurityReleasesMicrosoft 365 Apps for Enterprise (Microsoft): https://aka.ms/OfficeSecurityReleases

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft Office 2019	19.0.0 to before https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases	Patch available	CNA
Microsoft	Microsoft 365 Apps for Enterprise	16.0.1 to before https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases	Patch available	CNA

Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
Microsoft 365 Apps for Enterprise VendorMicrosoft Affected 16.0.1 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:365_apps:-:::::::*	not specified by NVD	Vulnerable	Microsoft
cpe:2.3:a:microsoft:office:2019:::::-::	2019	Vulnerable	Microsoft

cpe:2.3:a:microsoft:365_apps:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:* Versions 2019 Vulnerable ·Microsoft

Remediation

Fix · CNA Microsoft Office 2019 (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
Fix · CNA Microsoft 365 Apps for Enterprise (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases

Timeline

2026-10-02 Threatist record created from CVE-2020-16957
2026-10-03 Alias added: GHSA-7ch6-cg9m-mgp4
2026-10-14 EPSS moved to the 90th–95th percentile

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16957

TI-2024-14173 Microsoft Outlook Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-25471 Microsoft Project Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2026-17368 Microsoft Word Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
TI-2026-17363 Microsoft Office Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8

See all 935 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences