CVE-2016-7265

HIGH

Microsoft Excel Out-of-bounds Read via Crafted Document

Title source: llm

Description

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability."

References (3)

Core 3

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94721

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1037441

Scores

CVSS v3 7.1

EPSS 0.2257

EPSS Percentile 97.4%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Details

CWE

CWE-125

Status published

Products (8)

microsoft/excel 2007 sp3

microsoft/excel 2010 sp2

microsoft/excel 2013 sp1 (2 CPE variants)

microsoft/excel 2016

microsoft/excel_viewer

microsoft/office_compatibility_pack

microsoft/sharepoint_server 2007 sp3

microsoft/sharepoint_server 2010 sp2

Published Dec 20, 2016

Tracked Since Feb 18, 2026