CVE-2016-3303: Input Validation
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3304.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3303?
CVE-2016-3303 has a critical severity rating due to its potential to allow remote code execution.
How do I fix CVE-2016-3303?
To fix CVE-2016-3303, apply the security updates provided by Microsoft for the affected software versions.
Which software is affected by CVE-2016-3303?
CVE-2016-3303 affects Microsoft Windows Vista, Windows Server 2008, Windows 7, Office 2007, Office 2010, and several versions of Microsoft Lync and Skype for Business.
What can attackers do due to CVE-2016-3303?
Attackers exploiting CVE-2016-3303 can execute arbitrary code on the affected system.
Is there a workaround for CVE-2016-3303?
While the recommended solution is to apply updates, users may limit exposure by disabling or removing vulnerable applications temporarily.