Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which a…

Published 10 y ago 2016-08-09 · modified 4 mo ago 2026-06-17 · JSON

CVSS

2.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

37.9%

percentile 99%

Public exploits

Metasploit

Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure Vulnerability."

Exploit prediction (EPSS)

37.95% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

Metasploit auxiliary/gather/ie_sandbox_findfiles Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability · metasploit auxiliary, normal rank · 2016-08-09

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	2.5	`CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N`
NVD	2.0	1.9	`AV:L/AC:M/Au:N/C:P/I:N/A:N`

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-095 · vendor-advisory, x_refsource_MS, x_transferred
securitytracker.com /id/1036562 · vdb-entry, x_refsource_SECTRACK, x_transferred
securify.nl /advisory/SFY20160301/internet_explorer_iframe_sandbox_local_file_name_disclosure_vulnerab · x_refsource_MISC, x_transferred
seclists.org /fulldisclosure/2016/Aug/44 · mailing-list, x_refsource_FULLDISC, x_transferred
securityfocus.com /archive/1/539174/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
securityfocus.com /bid/92291 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2016-3321
NVD: CVE-2016-3321

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.