Description
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7290.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94671
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1037441
Scores
CVSS v3
7.1
EPSS
0.1094
EPSS Percentile
93.5%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (8)
microsoft/office
2010 sp2
microsoft/office_compatibility_pack
microsoft/office_web_apps
2010 sp2
microsoft/sharepoint_server
2010 sp2
microsoft/word
2007 sp3
microsoft/word
2010 sp2
microsoft/word_automation_services
microsoft/word_for_mac
2011
Published
Dec 20, 2016
Tracked Since
Feb 18, 2026