CVE-2016-7182

CRITICAL

Microsoft Windows Vista - Improper Input Validation

Title source: rule

Description

The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows attackers to execute arbitrary code via a crafted True Type font, aka "True Type Font Parsing Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WRITEUP VERIFIED

by Google Security Research · textdoswindows

https://www.exploit-db.com/exploits/40599

View Code ZIP pw:eip

References (3)

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1036988

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/93395

Scores

CVSS v3 9.8

EPSS 0.3505

EPSS Percentile 97.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (18)

microsoft/live_meeting 2007

microsoft/lync 2010 (2 CPE variants)

microsoft/lync 2013 sp1

microsoft/office 2007 sp3

microsoft/office 2010 sp2

microsoft/skype_for_business 2016

microsoft/windows_10

microsoft/windows_10 1511

microsoft/windows_10 1607

microsoft/windows_7

... and 8 more

Published Oct 14, 2016

Tracked Since Feb 18, 2026