Microsoft Office
CVE-2020-16955 — Microsoft Office Click-to-Run Elevation of Privilege Vulnerability
Executive Summary
An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) AppVLP handles certain files. An attacker who successfully exploited the vulnerability could elevate privileges. To exploit this vulnerability, an attacker would need to convince a user to open a specially crafted file. The security update addresses the vulnerability by correcting how Microsoft Office Click-to-Run (C2R) components handle these files.
Overview
7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
Required
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.0
EPSS Score
0.03482
probability of exploitation in the next 30 days
0.87885 percentile - updated 2026-07-25
View on FIRST.org
Affected Products
6 affected products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Microsoft 365 Apps for Enterprise for 32-bit Systems | Click to Run (Security Update) |
Important | Elevation of Privilege | Maybe |
| Microsoft 365 Apps for Enterprise for 64-bit Systems | Click to Run (Security Update) |
Important | Elevation of Privilege | Maybe |
| Microsoft Office 2013 Click-to-Run (C2R) for 32-bit editions | Click to Run (Security Update) |
Important | Elevation of Privilege | Maybe |
| Microsoft Office 2013 Click-to-Run (C2R) for 64-bit editions | Click to Run (Security Update) |
Important | Elevation of Privilege | Maybe |
| Microsoft Office 2019 for 32-bit editions | Click to Run (Security Update) |
Important | Elevation of Privilege | Maybe |
| Microsoft Office 2019 for 64-bit editions | Click to Run (Security Update) |
Important | Elevation of Privilege | Maybe |
Patches
1 patch
| Article | Type | Restart |
|---|---|---|
Click to Run |
Security Update | Maybe |
Known Exploits
No known exploits have been linked for this CVE yet. When available, exploit references will be sourced from public repositories and may be unverified, incomplete, or non-functional. Always review code carefully before use in any environment.
Acknowledgments
Ben Faull of Microsoft Corporation
References
On This Page