CVE-2016-0041

HIGH

Internet Explorer - DLL Loading Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-0041.

AI-analyzed exploit summary This Metasploit module exploits multiple DLL side-loading vulnerabilities in various COM components by embedding a malicious OLE object in a PowerPoint file. When opened, the file triggers the loading of a malicious DLL from the current directory, leading to arbitrary code execution.

Description

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."

Exploits (1)

exploitdb WORKING POC
rubylocalwindows
https://www.exploit-db.com/exploits/41706

This Metasploit module exploits multiple DLL side-loading vulnerabilities in various COM components by embedding a malicious OLE object in a PowerPoint file. When opened, the file triggers the loading of a malicious DLL from the current directory, leading to arbitrary code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (2007-2016) and Windows (Vista-10)
No auth needed
Prerequisites: Victim must open a specially crafted PowerPoint file from a directory containing the attacker's DLL
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034985
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2016/Feb/49
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034971

Scores

CVSS v3 7.8
EPSS 0.5828
EPSS Percentile 98.2%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (12)
microsoft/internet_explorer 10
microsoft/internet_explorer 11
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_7
microsoft/windows_8.1
microsoft/windows_rt_8.1
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
microsoft/windows_server_2012
... and 2 more
Published Feb 10, 2016
Tracked Since Feb 18, 2026