What’s Vulnerable › Vulnerabilities

CVE-2020-1581: Microsoft Office Click-to-Run Elevation of Privilege Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-17 · updated 2026-06-17

Description

An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the system. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The security update addresses the vulnerability by correcting how Microsoft Office Click-to-Run (C2R) components handle objects in memory.

Affected products

• Microsoft 365 Apps: all versions
• Microsoft Office: 2013, 2019
• Microsoft 365 Apps: from 16.0.1 before https://aka.ms/OfficeSecurityReleases — fixed in https://aka.ms/OfficeSecurityReleases
• Microsoft Office 2013 Click-to-Run (C2R): from 15.0.0.0 before 15.0.5571.1000 — fixed in 15.0.5571.1000
• Microsoft Office: from 19.0.0 before https://aka.ms/OfficeSecurityReleases — fixed in https://aka.ms/OfficeSecurityReleases

How to fix

Upgrade to a fixed version: Microsoft 365 Apps https://aka.ms/OfficeSecurityReleases; Microsoft Office 2013 Click-to-Run (C2R) 15.0.5571.1000; Microsoft Office https://aka.ms/OfficeSecurityReleases. Check the vendor advisory for mitigations.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1581
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1581

Get alerted when CVE-2020-1581 or the next vulnerability affects your stack