7.8high
CVE-2016-3313in critical feed1 exploit
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute…
Published 10 y ago · modified 22 d ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
49.8%
percentile 99%
Public exploits
1
Exploit-DB
Summary
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 22 d ago
Exploit prediction (EPSS)
49.83% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-40224 Microsoft Word 2007/2010/2013/2016 - Out-of-Bounds Read Code Execution (MS16-099) · local · 2016-08-10
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- securitytracker.com /id/1036559 · vdb-entry, x_refsource_SECTRACK, x_transferred
- docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-099 · vendor-advisory, x_refsource_MS, x_transferred
- exploit-db.com /exploits/40224/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- securityfocus.com /bid/92289 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-3313
- NVD: CVE-2016-3313
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.