Main Vulnerability Database Vulnerabilities #VU5244

Memory corruption in Microsoft Edge and Microsoft Internet Explorer - CVE-2016-3325

Published: September 13, 2016 / Updated: September 14, 2018

Vulnerability identifier: #VU5244

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3325

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to boundary error when handling a malicious file. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and gain access to potentially sensitive data.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Affected software

Microsoft Edge
Microsoft Internet Explorer

How to mitigate CVE-2016-3325

Install update from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #853 - Microsoft WININET.dll - CHttpHeaderParser::ParseStatusLine Out-of-Bounds Read (MS16-104/MS16-105) (March 18, 2020)

External References

https://technet.microsoft.com/en-us/library/security/ms16-104