CVE-2016-0015

HIGH

Microsoft Windows - Remote Code Execution via Crafted File in DirectShow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-0015. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit demonstrates a heap corruption buffer underflow in devenum.dll!DeviceMoniker::Load() due to improper NULL termination of a user-supplied string. It leverages a crafted Word document with an embedded OLE object to trigger the vulnerability, leading to potential remote code execution.

Description

DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "DirectShow Heap Corruption Remote Code Execution Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/39232

The exploit demonstrates a heap corruption buffer underflow in devenum.dll!DeviceMoniker::Load() due to improper NULL termination of a user-supplied string. It leverages a crafted Word document with an embedded OLE object to trigger the vulnerability, leading to potential remote code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows 7 x86 (devenum.dll)
No auth needed
Prerequisites: User interaction (single-click on embedded OLE object in Word document) · Target system running Windows 7 x86
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034660
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/39232/
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007

Scores

CVSS v3 7.8
EPSS 0.5127
EPSS Percentile 98.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (10)
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_7
microsoft/windows_8
microsoft/windows_8.1
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1 (2 CPE variants)
microsoft/windows_server_2012
microsoft/windows_server_2012 r2
microsoft/windows_vista
Published Jan 13, 2016
Tracked Since Feb 18, 2026