CVE-2016-5228 Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to...

CriticalCVSS 9.8 EPSS 15.1% PoC

Published: 2016-07-03 04:00
Updated: 2026-06-17 03:49
Exploit status: Proof-of-concept only

Description

Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument. NOTE: some references mention CVE-2016-5226 but that is not a correct ID for any Rumba vulnerability.

Affected products

Product	Affected versions	Fixed in
microfocus rumba	= 9.4	No fix listed

References

CVSS v3.0

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.0 9.8 · nvd@nist.gov
v2.0 10.0 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 15.12% (percentile 96.8)
CWE: CWE-119

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Micro Focus Rumba 9.3 - ActiveX Stack Buffer Overflow (PoC) PoC · Exploit Database (OffSec) · 2016-10-31