CVE-2016-3304: microsoft live_meeting Improper Input Validation
Vulnerability summary
CVE-2016-3304 is a high (CVSS 9.3) Improper Input Validation vulnerability in microsoft live_meeting. EPSS estimates a 50.51% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-08-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3303.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
50.51%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 50.51% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft Windows - GDI+ EMR_EXTTEXTOUTA / EMR_POLYTEXTOUTA Heap Buffer Overflow (MS16-097)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Microsoft5 products
- live_meeting2007
- lync2010 | 2013:sp1
- office2007:sp3 | 2010:sp2
- skype_for_business2016
- windows_server_2008r2:sp1
1 vendor · 5 products
References
4 links
docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097Vendor AdvisoryX Refsource MS