Skip to content
OpenAdvisories
High MSRC-CVE-2026-20943 1 CVE

Microsoft Office Click-To-Run Remote Code Execution Vulnerability

Published Jan 13, 2026 · Updated Jan 20, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.

Are there additional steps I need to take to be protected from this vulnerability?
Customers should download the latest Office Deployment Tool (ODT) and ensure that this version, or any newer version, is used for all future deployments to remain protected against CVE-2026-20943.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A user would need to be tricked into opening a folder that contains a specially crafted file.

Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.

Security updates
16.0.10417.20083 — https://support.microsoft.com/help/5002825
16.0.5535.1000 — https://support.microsoft.com/help/5002826
16.0.5535.1001 — https://support.microsoft.com/help/5002828
16.0.19127.20442 — https://support.microsoft.com/help/5002822
16.0.19426.20170 — https://www.microsoft.com/en-in/download/details.aspx?id=49117&msockid=35f9adb0e74b61392038b90de6fe608c

Vulnerabilities 1

Revision history

  1. #2

    Updated FAQ information. This is an informational change only.

  2. #3

    Corrected CVE title. This is an informational change only.

  3. #1

    Information published.

References