CVE-2016-3304

HIGH

Microsoft Windows and Office - Remote Code Execution via Crafted Embedded Font

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-3304. PoCs published by Google Security Research.

AI-analyzed exploit summary This is a detailed writeup describing a heap corruption vulnerability in Microsoft GDI+ due to improper validation of the 'offDx' field in EMF records, leading to out-of-bounds writes during text rendering. The analysis includes a crash log and exploitation steps but does not contain executable exploit code.

Description

The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3303.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/40257

This is a detailed writeup describing a heap corruption vulnerability in Microsoft GDI+ due to improper validation of the 'offDx' field in EMF records, leading to out-of-bounds writes during text rendering. The analysis includes a crash log and exploitation steps but does not contain executable exploit code.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft GDI+ (affecting Microsoft Office 2013 and other applications processing EMF files)
No auth needed
Prerequisites: A maliciously crafted EMF file · Victim interaction to open the file in a vulnerable application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92302
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40257/
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036564

Scores

CVSS v3 7.8
EPSS 0.5051
EPSS Percentile 98.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (11)
microsoft/live_meeting 2007
microsoft/lync 2010 (2 CPE variants)
microsoft/lync 2013 sp1
microsoft/office 2007 sp3
microsoft/office 2010 sp2
microsoft/skype_for_business 2016
microsoft/windows_7
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
microsoft/windows_vista
... and 1 more
Published Aug 09, 2016
Tracked Since Feb 18, 2026