Description
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability."
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94721
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1037441
Scores
CVSS v3
7.1
EPSS
0.1027
EPSS Percentile
93.3%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (8)
microsoft/excel
2007 sp3
microsoft/excel
2010 sp2
microsoft/excel
2013 sp1 (2 CPE variants)
microsoft/excel
2016
microsoft/excel_viewer
microsoft/office_compatibility_pack
microsoft/sharepoint_server
2007 sp3
microsoft/sharepoint_server
2010 sp2
Published
Dec 20, 2016
Tracked Since
Feb 18, 2026