KEV · Actively exploited

CVE-2016-3235

CVE-2016-3235 is actively exploited (CISA KEV catalog) : high severity (CVSS 7.8), 0 tracked apps concerned, none still exposed on their current version.

Severity (CVSS): 7.8
Exploitation: Confirmed
Tracked apps: 0
Still exposed: 0

Public exploit : ExploitDB Published on 2016-06-16

Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

Attack vector : Local No privileges required

Show raw CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS 43.43% predictive model; CISA confirms active exploitation percentile 98.6%

CISA Known Exploited Vulnerability

Added to KEV: 2021-11-03
Remediation deadline: 2022-05-03
Required action: Apply updates per vendor instructions.
Ransomware: Unknown (not documented by CISA)

View on NVD ↗ CISA KEV catalog ↗ Advisory · docs.microsoft.com