CVE-2016-3301

HIGH

Microsoft Windows and Office - Remote Code Execution via Crafted Embedded Font

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-3301. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages an integer overflow in GDI+ library's BI_RLE8 decompression, causing a heap-based buffer overflow in 32-bit Large Address Aware applications. The PoC demonstrates a crash via a crafted EMF file with malformed bitmap records.

Description

The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/40255

This exploit leverages an integer overflow in GDI+ library's BI_RLE8 decompression, causing a heap-based buffer overflow in 32-bit Large Address Aware applications. The PoC demonstrates a crash via a crafted EMF file with malformed bitmap records.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Microsoft GDI+ (gdiplus.dll) on Windows 7 64-bit (version 1.1.7601.23407)
No auth needed
Prerequisites: 32-bit Large Address Aware application processing EMF files · Crafted EMF file with malformed bitmap records
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92288
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40255/
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036564

Scores

CVSS v3 7.8
EPSS 0.4449
EPSS Percentile 98.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (18)
microsoft/live_meeting 2007
microsoft/lync 2010 (2 CPE variants)
microsoft/lync 2013 sp1
microsoft/office 2007 sp3
microsoft/office 2010 sp2
microsoft/skype_for_business 2016
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_10 1607
microsoft/windows_7
... and 8 more
Published Aug 09, 2016
Tracked Since Feb 18, 2026