CVE-2016-3235
Microsoft Office OLE DLL Side Loading Vulnerability
Description
CVE-2016-3235 is a high-severity DLL side loading vulnerability in Microsoft Office, specifically affecting Microsoft Visio. The vulnerability exists because the Object Linking and Embedding (OLE) dynamic link library improperly validates input before loading libraries, allowing a local attacker to execute arbitrary code with the privileges of the current user. CISA has added CVE-2016-3235 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 81.16% (99.1th percentile), this vulnerability has a very high probability of exploitation, indicating widespread targeting of affected Microsoft Visio installations.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | visio | 2007; 2010; 2013; 2016 |
| microsoft | visio viewer | 2007; 2010 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/137490/Microsoft-Visio-DLL-Hijacking.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2016/Jun/32(Broken Link, Mailing List, Third Party Advisory)
- http://www.securityfocus.com/archive/1/538685/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036093(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-070(Patch, Vendor Advisory)
- https://www.securify.nl/advisory/SFY20150804/microsoft_visio_multiple_dll_side_loading_vulnerabilities.html(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3235(US Government Resource)
Weakness Type
DLL Side Loading
DLL side loading occurs when an application loads a malicious dynamic link library instead of the intended legitimate one. In the case of CVE-2016-3235, Microsoft Visio's OLE component fails to properly validate library paths before loading, allowing an attacker to place a crafted DLL in a location where Visio will load it instead of the legitimate library.
Learn more: DLL Side Loading — MITRE ATT&CK
Impact Analysis
CVE-2016-3235 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a significant threat to affected systems. The vulnerability requires local access and user interaction, meaning an attacker must convince a user to open a malicious file or navigate to a directory containing a crafted DLL. However, the attack complexity is low and no special privileges are required. Successful exploitation leads to full compromise of confidentiality, integrity, and availability on the affected system, allowing the attacker to execute arbitrary code in the context of the current user. With an EPSS score of 81.16%, CVE-2016-3235 is among the most likely vulnerabilities to be exploited, making immediate patching essential for organizations running Microsoft Visio.
Exploit Maturity
CVE-2016-3235 has a well-documented exploit landscape. Public exploit code is available via Packet Storm Security and a detailed Securify advisory documenting the DLL hijacking technique. CISA has confirmed active exploitation in the wild by including CVE-2016-3235 in the Known Exploited Vulnerabilities catalog. The EPSS score of 81.16% (99.1th percentile) indicates near-certain exploitation activity, placing this vulnerability in the top 1% of all CVEs by exploitation probability.
Remediation
- Apply the Microsoft security update MS16-070 as required by CISA KEV guidance. This bulletin addresses the OLE DLL side loading vulnerability across all affected Visio products.
- Upgrade all instances of Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 to their latest patched versions.
- As an interim mitigation, restrict write access to directories from which Visio loads DLLs. Configure Windows DLL search order hardening via the CWDIllegalInDllSearch registry key to prevent loading libraries from the current working directory.
- Monitor endpoints for suspicious DLL loading activity using application whitelisting tools or endpoint detection and response (EDR) solutions. Look for unsigned or unexpected DLLs loaded by Visio processes.
- Educate users about the risks of opening Visio files from untrusted sources or shared network directories, as the attack requires user interaction to trigger the malicious DLL load.
Technical Details
CVE-2016-3235 exploits a DLL side loading weakness in Microsoft Visio's OLE component. When Visio processes certain file types, it loads dynamic link libraries using a search order that includes the current working directory. An attacker can place a malicious DLL with a specific name in the same directory as a Visio file, and when the user opens that file, Visio loads the attacker's DLL instead of the legitimate system library. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that exploitation requires local access and user interaction but is otherwise straightforward, with full impact on confidentiality, integrity, and availability once the malicious code executes in the context of the user's session.
Frequently Asked Questions
Is CVE-2016-3235 being actively exploited?
Yes. CVE-2016-3235 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 81.16% (99.1th percentile) further indicates a very high probability of exploitation.
What products are affected by CVE-2016-3235?
CVE-2016-3235 affects Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010. All of these products contain the vulnerable OLE DLL loading mechanism.
How do I fix CVE-2016-3235?
Apply the Microsoft security update MS16-070 immediately. Upgrade all affected Visio installations to their latest patched versions. As an interim measure, restrict DLL loading paths and configure CWDIllegalInDllSearch to harden the DLL search order.
How severe is CVE-2016-3235?
CVE-2016-3235 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access and user interaction, successful exploitation grants full code execution. The extremely high EPSS score of 81.16% places it in the top 1% of vulnerabilities most likely to be exploited.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.