CVE-2016-7266

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.8HIGH
EPSS
16.9%
top 5.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft ExcelMicrosoft Excel FOR MAC
Timeline
PublishedDec 20
Latest updateMay 14

Description

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel 2016 for Mac mishandle a registry check, which allows user-assisted remote attackers to execute arbitrary commands via crafted embedded content in a document, aka "Microsoft Office Security Feature Bypass Vulnerability."

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

▶NVDmicrosoft/excel4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-f86h-p5cj-45cr: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel 2016 f↗2022-05-14
▶
CVEList
CVE-2016-7266: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel 2016 f↗2016-12-20
▶

📋Vendor Advisories

1
Microsoft
Microsoft Excel Security Feature Bypass Vulnerability↗2016-12-13
▶
CVE-2016-7266 (HIGH CVSS 7.8) | Microsoft Excel 2007 SP3 | cvebase.io