CVE-2016-3304 is a remote code execution vulnerability in the Windows font library, affecting various Microsoft products including Windows Vista, Windows 7, Windows Server 2008, Office 2007/2010, Skype for Business, and Lync. This vulnerability allows attackers to execute arbitrary code by tricking a user into opening a document or viewing content with a specially crafted embedded font. It carries a high CVSS score of 7.8, indicating a significant risk with high impact on confidentiality, integrity, and availability, requiring user interaction (UI:R) for exploitation. While not listed in CISA's KEV catalog and showing no active exploitation or significant community discussion, a related exploit (EDB-40257) exists for a similar GDI+ heap buffer overflow, suggesting potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2007CPE matchmatch criteria | cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:lync:2010:*:attendee:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:* | ||
2007CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.