MS16-148: Description of the security update for Excel 2013: December 13, 2016

Applies to: Microsoft Office 2013 Service Pack 1Excel 2013


This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Security Bulletin MS16-148.

Note To apply this security update, you must have the release version of Service Pack 1 for Microsoft Office 2013 installed on the computer.

For a complete list of affected versions of Microsoft Office software, see Microsoft Knowledge Base article 3204068.

Known issue

After you install this update, you may receive the following error message when you use the Send as PDF or the Send as XPS function in Microsoft Excel 2013.
General mail failure. Quit Microsoft Excel, restart the mail system, and try again.
To fix this issue, install January 3, 2017, update for Excel 2013 (3141475).

Improvements and fixes

This security update contains improvements and fixes for the following nonsecurity issues:
  • Improve performance of rendering the custom filter list of items when the list contains long strings.
  • When a workbook is loaded in Microsoft SharePoint that has a PivotTable connected to a BISM file and it points to another workbook in the same farm, Power Pivot can't use some Korean DBCS characters in the formula bar.
  • It takes a long time to paste filtered selection data from large tables.
  • When an add-in or macro code tries to access a property on a shape control that no longer exists, Excel 2013 may crash. This update returns an error status instead of crashing.
  • When you try to load HTML documents that contain <input/> tags in the protected view, you receive a corrupted file alert, and the documents can't be opened.
  • When you select cells by dragging on a touch-enabled device, Excel 2013 may crash because of interactions with accessibility (UIA) APIs that are on by default.
  • After you import a table that has multi-line columns and the Enhanced Rich Text function configured from SharePoint to Excel, the text in the multi-line columns is preceded by a blank line.

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see the Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

More Information

Security update deployment information

For deployment information about this update, see Microsoft Knowledge Base article 3204068.

Security update replacement information

This security update replaces previously released security update 3127921.

File hash information

Package NamePackage Hash SHA 1Package Hash SHA 2