CVE-2016-3321

CVE-2016-3321 is an information disclosure vulnerability affecting Microsoft Internet Explorer 10 and 11. It allows a local attacker to enumerate files on a system by observing how the browser handles file:// URLs differently based on file existence, leveraging an HTML5 sandbox iframe. The vulnerability has a low CVSS score of 2.5, indicating low impact (confidentiality loss) and high attack complexity, requiring local access and no user interaction. While not listed in CISA's KEV catalog, a Metasploit module exists for this vulnerability, though there is no evidence of active exploitation or significant community discussion.