Information disclosure in Microsoft Edge and Microsoft Internet Explorer - CVE-2016-3267

Vulnerability identifier: #VU848

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3267

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to object memory handling error. A remote attacker can create a specially crafted content, trick the victim inro downloading it, trigger memory corruption and determine arbitrary files on the target system.

Successful exploitation of the vulnerability will result in information disclosure on the vulnerable system.

Microsoft Edge
Microsoft Internet Explorer

Install update from vendor's website.

• https://technet.microsoft.com/en-us/library/security/ms16-118
• https://technet.microsoft.com/en-us/library/security/ms16-119

• Multiple vulnerabilities in Microsoft Internet Explorer
• Multiple vulnerabilities in Microsoft Edge
• Microsoft Browser Information Disclosure Vulnerability