Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Wi…

published 2016-01-13 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-0055

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 29.7%; EPSS 29.7% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Exploit-DB

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."

Patch / fix

links 1

docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007 advisory

Timeline

2016-01-13 First public exploit (EDB-39233)
2016-01-13 Published

Exploit prediction

29.67% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-39233 Microsoft Office / COM Object - 'WMALFXGFXDSP.dll' DLL Planting (MS16-007) dos, 2016-01-13
code.google.com https://code.google.com/p/google-security-research/issues/detail?id=555 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-426 Untrusted Search Path

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-007
vendor-advisory, patch
exploit-db.com /exploits/39233/
exploit, third-party-advisory, vdb-entry
code.google.com /p/google-security-research/issues/detail?id=555
exploit, mailing-list, third-party-advisory
securitytracker.com /id/1034661
vdb-entry, third-party-advisory

Sources

CVE List CVE-2016-0016
NVD CVE-2016-0016

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary