{"id":"CVE-2016-3216","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-3216","generatedAt":"2026-10-27T17:58:18.836Z","title":"GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to bypass the ASLR…","description":"GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka \"Windows Graphics Component Information Disclosure Vulnerability.\"","published":"2016-06-16T01:59:21.000Z","lastModified":"2026-06-17T00:45:19.000Z","status":"Modified","sourceIdentifier":"secure@microsoft.com","cvss":{"version":"3.0","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},"cwe":["CWE-200"],"affected":["microsoft/windows 10","microsoft/windows 7","microsoft/windows 8.1","microsoft/windows rt 8.1","microsoft/windows server 2008","microsoft/windows server 2012","microsoft/windows vista"],"epss":{"score":0.24988,"percentile":0.97902,"date":"2026-10-26","history":[{"date":"2026-09-21","score":0.31488,"percentile":0.98247},{"date":"2026-09-22","score":0.24988,"percentile":0.97817}]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2016-06-21","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":39990,"kind":"exploit","title":"Microsoft Windows - 'gdi32.dll' Multiple DIB-Related EMF Record Handlers Heap Out-of-Bounds Reads/Memory Disclosure (MS16-074)","url":"https://www.exploit-db.com/exploits/39990","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/dos/39990.txt","file":"exploits/windows/dos/39990.txt","published":"2016-06-21","added":"2016-06-21","updated":"2016-06-21","author":"Google Security Research","type":"dos","platform":"windows","port":null,"verified":true,"codes":["CVE-2016-3216","MS16-074"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://bugs.chromium.org/p/project-zero/issues/detail?id=757"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 25.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.31488,"from":0.24988,"percentile":0.98247},"summary":"EPSS moved from 25.0% to 31.5% probability of exploitation in the next thirty days."}],"references":[{"url":"http://www.securitytracker.com/id/1036101","source":"secure@microsoft.com"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-074","source":"secure@microsoft.com"},{"url":"https://www.exploit-db.com/exploits/39990/","source":"secure@microsoft.com"},{"url":"http://www.securitytracker.com/id/1036101","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-074","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/39990/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-3216","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}