CVE-2016-3235: Microsoft Office OLE DLL Side Loading Vulnerability
Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."
Other sources
Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3235?
CVE-2016-3235 has a severity rating that can lead to privilege escalation for local users.
How do I fix CVE-2016-3235?
To fix CVE-2016-3235, users should apply the latest security updates provided by Microsoft for the affected Visio versions.
Which software versions are affected by CVE-2016-3235?
CVE-2016-3235 affects Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, and associated Visio Viewer versions.
What type of vulnerability is CVE-2016-3235?
CVE-2016-3235 is classified as a DLL side loading vulnerability that can allow local users to gain elevated privileges.
Can CVE-2016-3235 affect enterprise environments?
Yes, CVE-2016-3235 poses a risk to enterprise environments where affected versions of Microsoft Visio are in use.