CVE-2020-8137: 
JavaScript vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-8137) was identified in Microsoft Project 2013. The vulnerability exists when Microsoft Office incorrectly loads arbitrary type libraries (Microsoft Support).

The vulnerability affects Microsoft Project 2013 Standard and Project Professional 2013. The security update requires Service Pack 1 for Microsoft Office 2013 to be installed. The update applies specifically to Microsoft Installer (.msi)-based editions of Office 2013 and not to Click-to-Run editions such as Microsoft Office 365 Home (Microsoft Support).

If successfully exploited, this vulnerability could allow remote code execution on the affected system (Microsoft Support).

Microsoft released security update 4484125 to address this vulnerability. The update is available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center. Users can obtain the update through automatic updates or by downloading the standalone package for both 32-bit and 64-bit versions of Project 2013 (Microsoft Support).