CVE-2016-3303 is a remote code execution vulnerability in the Windows font library, affecting various Microsoft products including Windows Vista, Windows 7, Windows Server 2008, Office suites, Lync, and Skype for Business. With a CVSS score of 7.8 (High), successful exploitation could lead to complete compromise of confidentiality, integrity, and availability, requiring user interaction (e.g., opening a crafted document) to trigger. While it has a high EPSS and FAUCET risk score, there is no evidence of active exploitation in the wild, nor is it listed on CISA's KEV catalog. Although an ExploitDB entry exists for a related vulnerability (MS16-097), no direct Metasploit or Nuclei exploits are available, and community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2007CPE matchmatch criteria | cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:lync:2010:*:attendee:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:* | ||
2007CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.