Description of the security update for Project 2016: November 13, 2018

Applies to: Project Professional 2016Project Standard 2016


This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2018-8575.

Note To apply this security update, you must have the release version of Microsoft Project 2016 installed on the computer.

Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home (see Determining your Office version).

Improvements and fixes

This security update contains improvements and fixes for the following nonsecurity issues:
  • When you make changes in a project and then save it, the custom field lookup table values are also saved even though they have not been changed. Therefore, it takes longer to publish the project. And while the publishing processes, other actions such as viewing the tasks view in Project Web App may be slow.
  • Assume that you update cost or work data for a subtask in Project 2016. When you save a baseline on the task and choose the option to roll up the baseline data to all summary tasks, the baseline data for task summary tasks within the sub project is rolled up but not to the inserted project summary tasks and summary tasks in the master project.
Consider the following scenario:
  • You have a SharePoint document library.
  • The document library list experience is set to the new "modern" experience.
  • The document library versioning settings require checkout.
  • You have a Project file stored in the library. You open the file from the library by  using Project 2016.
In this situation, you find that the expected "check out required" prompt isn't displayed, and therefore you can't respond. This means that if you make changes to the project and save, Project tells you that the changes can't be saved because checkout is required.

How to get and install the update

Method 1: Microsoft Update
This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.
Method 2: Microsoft Update Catalog
To get the stand-alone package for this update, go to the Microsoft Update Catalog website.
Method 3: Microsoft Download Center
You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

More Information

Security update deployment information

For deployment information about this update, see security update deployment information: November 13, 2018.

Security update replacement information

This security update replaces previously released security update KB 2920698.

File hash information
File name SHA1 hash SHA256 hash
project2016-kb4461478-fullfile-x86-glb.exe B03466CBBA73FC1BA2297F19282B7264B182D949 BDA487B2A39F64DEA3CE995C9DE519A4BFFB0DE1838E8EF11AFAB2AA0203C249
project2016-kb4461478-fullfile-x64-glb.exe ADD40160E33BFF7CE64A10C5A0F4A62EBEFE3F0B 396EFFBE1AEE42D1F677134D10653FC85693D786DFB2994F746A1AA282259625
File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

How to get help and support for this security update

Protect yourself online and at home: Windows Security support
Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure
Local support according to your country: International Support