CVE-2016-0034KEV · OVERDUE

Microsoft Silverlight Runtime Remote Code Execution Vulnerability

High · published January 13, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.4th percentile for exploit probability.

1590
days past CISA
deadline
CVSS v3.1
8.8
EPSS
69%
Percentile
99.4
In the wild
Confirmed
What it is

🚨 A mishandling of negative offsets in Silverlight could let attackers seize control of your system — it's like letting a skilled magician perform tricks inside your house without checking for hidden assistants! 🔥 Imagine inviting a magician to your home to perform a show, but you accidentally leave the door open — anyone could sneak in while you're distracted. This vulnerability allows an attacker to execute code or crash the service just like a sneaky performer could surprise you with an unexpected twist! With this vulnerability, an attacker could unleash arbitrary code execution — that's a recipe for absolute chaos! They could steal sensitive information, disrupt your services, or even bring your whole system down. It's a high-stakes game with serious consequences!

Put simply

Imagine inviting a magician to your home to perform a show, but you accidentally leave the door open — anyone could sneak in while you're distracted. This vulnerability allows an attacker to execute code or crash the service just like a sneaky performer could surprise you with an unexpected twist! CVE-2016-0034 arises from the Silverlight 5 runtime's failure to properly handle negative offsets during decoding. This oversight allows remote attackers to leverage crafted web content to manipulate the application, leading to remote code execution or denial of service.

What to do

With this vulnerability, an attacker could unleash arbitrary code execution — that's a recipe for absolute chaos! They could steal sensitive information, disrupt your services, or even bring your whole system down. It's a high-stakes game with serious consequences! To protect your systems, immediately upgrade to Silverlight 5 version 5.1.41212.0 or later. Additionally, consider disabling Silverlight altogether, as it's no longer actively supported by Microsoft. Regularly review your web applications for any Silverlight dependencies to ensure you're not at risk! You've got this! With these steps, you can tighten up your defenses and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.69397 · 99.4th percentile
Published
2016-01-13T10:59Z
KEV added
2022-05-25 · due 2022-06-15
Affected products (1)
ProductVersionsFixed in
microsoft/silverlight≥ 5.0, < 5.1.41212.05.1.41212.0
References (5)
EPSS history
Timeline
  • 24 AUG 23:04Z
    EPSS moved 59% → 70%
    epss
  • 25 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 15
    kev
  • 13 JAN 02:00Z
    Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a…
    cvelistv5