CVE-2016-3235 Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted....
HighCVSS 7.8
EPSS 43.3%
CISA KEV
added 2021-11-03 · due 2022-05-03
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft visio | = 2007-sp3 | No fix listed |
| Microsoft visio | = 2010-sp2 | No fix listed |
| Microsoft visio | = 2013-sp1 | No fix listed |
| Microsoft visio | = 2016 | No fix listed |
| Microsoft visio viewer | = 2007-sp3 | No fix listed |
| Microsoft visio viewer | = 2010 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160615 Microsoft Visio multiple DLL side loading vulnerabilities broken-link mailing-list third-party-advisory
- 20160615 Microsoft Visio multiple DLL side loading vulnerabilities broken-link mailing-list third-party-advisory vdb-entry
- 1036093 broken-link third-party-advisory vdb-entry
- MS16-070 patch vendor-advisory
- www.securify.nl exploit third-party-advisory
- www.cisa.gov government-resource us-government-resource