CVE-2016-0015: Microsoft DirectShow heap corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh CVSS (7.8) with public exploit code and very high EPSS, though exploitation requires user interaction and no KEV listing exists.

What it is

DirectShow in multiple Microsoft Windows versions mishandles a crafted file, causing heap corruption (CWE-119). Because DirectShow is a media parsing component, opening a malicious file can lead to arbitrary code execution in the context of the user.

Impact

An attacker who gets a crafted file processed gains arbitrary code execution with the privileges of the logged-on user. On an administrative account this can mean full system compromise.

Attack surface

Reached locally through the processing of a crafted media file, with the CVSS vector requiring user interaction (UI:R) and no privileges (PR:N). No network vector is indicated; the file must be opened or rendered by the victim.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.49448, 98.8th percentile) and a public Exploit-DB entry (39232) exists, indicating exploit code is available.

What to do

• Apply Microsoft security bulletin MS16-007 for the affected Windows versions.
• Upgrade or retire unsupported platforms such as Windows Vista SP2 and Windows Server 2008 SP2/R2 SP1.
• Restrict opening of untrusted media files and enforce email/web attachment filtering.
• Run users with least privilege to limit the impact of code execution.

Detection

• Monitor for suspicious child processes spawned by media-handling applications such as explorer.exe or DirectShow-based players.
• Alert on crashes or heap corruption events in DirectShow-related modules.
• Hunt for known exploit file hashes or indicators tied to Exploit-DB 39232.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.