An elevation of privilege vulnerability exists in Microsoft Office OLicenseHeartbeat task, where an attacker who successfully exploited thi…

published 2020-02-11 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-2190

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits: 0; none known

An elevation of privilege vulnerability exists in Microsoft Office OLicenseHeartbeat task, where an attacker who successfully exploited this vulnerability could run this task as SYSTEM.To exploit the vulnerability, an authenticated attacker would need to place a specially crafted file in a specific location, thereby allowing arbitrary file corruption.The security update addresses the vulnerability by correcting how the process validates the log file., aka 'Microsoft Office Tampering Vulnerability'.

Patch / fix

links 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0697 advisory

Exploit prediction

0.90% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

Microsoft Office 365 ProPlus

References

portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2020-0697
patch, vendor-advisory

Sources

CVE List CVE-2020-0697
NVD CVE-2020-0697

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary