{"id":"CVE-2016-3303","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-3303","generatedAt":"2026-11-05T05:24:19.036Z","title":"The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007…","description":"The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka \"Windows Graphics Component RCE Vulnerability,\" a different vulnerability than CVE-2016-3304.","published":"2016-08-09T21:59:13.000Z","lastModified":"2026-06-17T00:45:28.000Z","status":"Modified","sourceIdentifier":"secure@microsoft.com","cvss":{"version":"3.0","score":7.8,"severity":"HIGH","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-20"],"affected":["microsoft/live meeting","microsoft/lync","microsoft/office","microsoft/skype for business","microsoft/word viewer","microsoft/windows 7","microsoft/windows server 2008","microsoft/windows vista"],"epss":{"score":0.50506,"percentile":0.98918,"date":"2026-11-04","history":[{"date":"2026-09-21","score":0.418,"percentile":0.98667},{"date":"2026-09-22","score":0.50506,"percentile":0.98862}]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2016-08-17","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":40256,"kind":"exploit","title":"Microsoft Windows - GDI+ ValidateBitmapInfo Invalid Pointer Arithmetic Out-of-Bounds Reads (MS16-097)","url":"https://www.exploit-db.com/exploits/40256","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/dos/40256.txt","file":"exploits/windows/dos/40256.txt","published":"2016-08-17","added":"2016-08-17","updated":"2016-10-31","author":"Google Security Research","type":"dos","platform":"windows","port":null,"verified":true,"codes":["CVE-2016-3303","MS16-097"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://bugs.chromium.org/p/project-zero/issues/detail?id=826"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 50.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.50506,"from":0.418,"percentile":0.98862},"summary":"EPSS moved from 41.8% to 50.5% probability of exploitation in the next thirty days."}],"references":[{"url":"http://www.securityfocus.com/bid/92301","source":"secure@microsoft.com"},{"url":"http://www.securitytracker.com/id/1036564","source":"secure@microsoft.com"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097","source":"secure@microsoft.com"},{"url":"https://www.exploit-db.com/exploits/40256/","source":"secure@microsoft.com"},{"url":"http://www.securityfocus.com/bid/92301","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1036564","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/40256/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-3303","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}