5.5med
CVE-2016-3279
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 20…
Published 10 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
16.4%
percentile 97%
Public exploits
0
none known
Summary
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Excel 2016, Word 2016, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted XLA file, aka "Microsoft Office Remote Code Execution Vulnerability."
Exploit prediction (EPSS)
16.42% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
- CWE-254 7PK - Security Features
References
- securitytracker.com /id/1036274 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securitytracker.com /id/1036275 · vdb-entry, x_refsource_SECTRACK, x_transferred
- docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-088 · vendor-advisory, x_refsource_MS, x_transferred
- securityfocus.com /bid/91587 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-3279
- NVD: CVE-2016-3279
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.