CVE-2016-3209

CVE-2016-3209 is an information disclosure vulnerability in the Graphics Device Interface (GDI/GDI+) of various Microsoft Windows versions, Office products, Lync, Skype for Business, .NET Framework, and Silverlight. This flaw, also known as "True Type Font Parsing Information Disclosure Vulnerability," allows remote attackers to bypass Address Space Layout Randomization (ASLR). With a CVSS score of 5.5 (Medium), it requires user interaction (UI:R) and local access (AV:L) to achieve high confidentiality impact (C:H) without affecting integrity or availability. While not actively exploited in the wild (KEV: No) and lacking significant community discussion or media coverage, an ExploitDB entry (EDB-40598) exists, indicating potential for exploitation.