CVE-2016-3235KEV · OVERDUE

Microsoft Office OLE DLL Side Loading Vulnerability

High · published June 16, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.8
EPSS
43%
Percentile
98.7
In the wild
Confirmed
What it is

🚨 A cleverly crafted app could grant local users higher privileges through Microsoft Visio vulnerabilities! ⚡ Think of it as a sneaky office intern who can access the CEO's files just by presenting a fake ID—it sounds absurd, but without the proper checks, they could get in! This vulnerability could lead to unauthorized access, allowing an attacker to execute malicious code with elevated permissions. Imagine an intruder taking over sensitive operations in your organization, changing documents, or even accessing confidential data—it's absolutely devastating!

Put simply

Think of it as a sneaky office intern who can access the CEO's files just by presenting a fake ID—it sounds absurd, but without the proper checks, they could get in! The Microsoft Office OLE DLL side loading vulnerability arises from improper library loading in multiple versions of Visio, allowing local users to exploit this flaw with a crafted application to gain higher privileges.

What to do

This vulnerability could lead to unauthorized access, allowing an attacker to execute malicious code with elevated permissions. Imagine an intruder taking over sensitive operations in your organization, changing documents, or even accessing confidential data—it's absolutely devastating! Immediately update your Microsoft Visio to the latest version to patch this vulnerability. Ensure that users are aware of the risks associated with running untrusted applications. Implement strict permissions and monitoring to detect any suspicious activities. 🛡️ You've got this! With these steps, you can easily secure your systems and maintain hero status in the world of security! 🦸‍♂️🦸‍♀️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.43308 · 98.7th percentile
Published
2016-06-16T01:00Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 16 JUN 01:00Z
    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows…
    cvelistv5