CVE-2016-3303

HIGH

Microsoft Windows and Office Products - Remote Code Execution via Crafted Embedded Font

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-3303. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a memory corruption vulnerability in GDI+ due to improper validation of bitmap headers in EMF files, leading to an out-of-bounds memory access. The PoC demonstrates a crash via a malformed EMR_PLGBLT record with crafted biWidth, biHeight, biPlanes, and biBitCount values.

Description

The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3304.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/40256

This exploit leverages a memory corruption vulnerability in GDI+ due to improper validation of bitmap headers in EMF files, leading to an out-of-bounds memory access. The PoC demonstrates a crash via a malformed EMR_PLGBLT record with crafted biWidth, biHeight, biPlanes, and biBitCount values.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Microsoft GDI+ (gdiplus.dll) on Windows 7 and Microsoft Office 2013
No auth needed
Prerequisites: Ability to deliver a malicious EMF file to the target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40256/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92301
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036564

Scores

CVSS v3 7.8
EPSS 0.5051
EPSS Percentile 98.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (11)
microsoft/live_meeting 2007
microsoft/lync 2010 (2 CPE variants)
microsoft/lync 2013 sp1
microsoft/office 2007 sp3
microsoft/office 2010 sp2
microsoft/skype_for_business 2016
microsoft/windows_7
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
microsoft/windows_vista
... and 1 more
Published Aug 09, 2016
Tracked Since Feb 18, 2026