CVE-2016-0136

HIGH

Microsoft Excel/Office 2007/2010 RCE via Crafted Document

Title source: llm

Description

Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

References (4)

Core 4

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-042

Various Sources third-party-advisory x_refsource_idefense

https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1224

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035525

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035524

Scores

CVSS v3 7.8

EPSS 0.2072

EPSS Percentile 97.2%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (5)

microsoft/excel 2007 sp3

microsoft/excel 2010 sp2

microsoft/office_compatibility_pack

microsoft/sharepoint_designer 2007 sp3

microsoft/sharepoint_foundation 2010 sp2

Published Apr 12, 2016

Tracked Since Feb 18, 2026