Description
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3303.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/40257
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/92302
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/40257/
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1036564
Scores
CVSS v3
7.8
EPSS
0.5298
EPSS Percentile
98.0%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (11)
microsoft/live_meeting
2007
microsoft/lync
2010 (2 CPE variants)
microsoft/lync
2013 sp1
microsoft/office
2007 sp3
microsoft/office
2010 sp2
microsoft/skype_for_business
2016
microsoft/windows_7
microsoft/windows_server_2008
microsoft/windows_server_2008
r2 sp1
microsoft/windows_vista
... and 1 more
Published
Aug 09, 2016
Tracked Since
Feb 18, 2026