This security update resolves a remote code execution vulnerability that exists if Microsoft Office incorrectly loads arbitrary type libraries. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2020-0760.
Note To apply this security update, you must have the release version of Project 2016 installed on the computer.
Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home (see What version of Office am I using?).
Some types of Visual Basic for Applications (VBA) references might be affected by this update. For more information, see FAQ for VBA solutions affected by April 2020 Office security updates.
Note This change in behavior is caused by a design change in Office. The new behavior is by design. Therefore, a fix is not necessary and no mitigation will be provided.
Improvements and fixes
This security update contains fixes for the following nonsecurity issue:
- Users can't create external task dependencies in the Japanese version of Project 2016. For example, creating a predecessor from a task in one project to a task in a different project.
- The OnUndoOrRedo event within a COM Add-in doesn't fire without first enabling a transaction.
- Assume that the timescale is set up to have a middle and bottom timescale set to Quarters over Months. When you print the timescale together with the Hriji calendar, the ending month in the quarter may get clipped. For example, the "Oct" month is moved into the third quarter, and "Sep" is skipped completely.
- The ProjectBeforeTaskChange event doesn't fire when you select the Inactivate button in the Scheduling group on the Tasks tab.
- Consider the following scenario:
- A project is saved to Project Server.
- The project has a local custom field that has a lookup table.
- The CustomFieldGetValueListGetItem method is invoked on a local custom field that doesn’t have a lookup table.
- The project is closed, saved, and checked in.
In this scenario, the values that are in the local custom field on which the method is run may be lost.
How to get and install the update
Method 1: Microsoft Update
This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.
Method 2: Microsoft Update Catalog
To get the standalone package for this update, go to the Microsoft Update Catalog website.
Method 3: Microsoft Download Center
You can get the standalone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.
Security update deployment information
For deployment information about this update, see security update deployment information: April 14, 2020.
Security update replacement information
This security update replaces previously released security update 4475589.
File hash information
|File name||SHA1 hash||SHA256 hash|
The English (United States) version of this software update installs files that have the attributes that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.