EXPOSURES › CVE-2016-3298
CVE-2016-3298
HIGH ⌖ ON CISA KEV · EXPLOITEDAn information disclosure vulnerability in Internet Explorer's Messaging API allowed attackers to test for file presence on disk.
Internet Explorer's Messaging API mishandled memory objects, enabling attackers to probe the filesystem. Because IE is end-of-life and unsupported, this unpatched flaw remains exploitable, violating NIST 800-171 requirements for patching and software lifecycle management. DIBs must ensure no legacy browsers are deployed and that all software is maintained per the Security Content Automation Protocol (SCAP) and NIST 800-53 controls.
Shame score — Microsoft shipped an end-of-life product with a known, unpatched vulnerability that was actively exploited in the wild, reflecting poor lifecycle management and delayed patching for a critical component.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |