Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-0145

CWE-119 — Buffer Overflow6 documents6 sources
Severity
8.8HIGH
EPSS
74.8%
top 1.14%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
Microsoft .net FrameworkMicrosoft Live MeetingMicrosoft Lync+5 more
Timeline
PublishedApr 12
Latest updateMay 14

Description

The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶NVDmicrosoft/lync2010, 2013+1
▶NVDmicrosoft/skype2016

🔴Vulnerability Details

2
GHSA
GHSA-4crq-7m6j-8297: The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8↗2022-05-14
▶
CVEList
CVE-2016-0145: The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8↗2016-04-12
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows Kernel - 'win32k.sys' TTF Processing EBLC / EBSC Tables Pool Corruption (MS16-039)↗2016-04-28
▶

📋Vendor Advisories

1
Microsoft
GDI+ Remote Code Execution Vulnerability↗2016-04-12
▶
CVE-2016-0145 (HIGH CVSS 8.8) | The font library in Microsoft Windo | cvebase.io