System Information Disclosure in Microsoft Edge and Microsoft Internet Explorer - CVE-2016-3326

Detailed vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to out-of-bound read when handling objects in memory. A remote attacker can create a specially crafted web page, trick a victim to open that page in browser and obtain potentially sensitive information from system memory.

Successful exploitation of this vulnerability my allow an attacker to obtain potentially sensitive information to perform further attacks against vulnerable system.

How to mitigate CVE-2016-3326

Sources

• https://technet.microsoft.com/en-us/library/security/ms16-095.aspx
• https://technet.microsoft.com/en-us/library/security/ms16-096.aspx