CVE-2016-3374

MEDIUM

Microsoft Edge - Information Disclosure

Title source: rule

Description

The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information via a crafted web site, aka "PDF Library Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3370.

References (6)

[Various Sources] http://blog.malerisch.net/2016/09/microsoft--out-of-bounds-read-pdf-library-cve-2016-3374.html

[Various Sources] http://srcincite.io/advisories/src-2016-39/

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1036789

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/92838

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-105

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-115

Scores

CVSS v3 6.5

EPSS 0.3231

EPSS Percentile 96.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (9)

n/a/n/a

microsoft/edge

microsoft/windows_10

microsoft/windows_10

microsoft/windows_10

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2012

microsoft/windows_server_2012

Timeline

Published Sep 14, 2016

Tracked Since Feb 18, 2026