CVE-2016-0034: Microsoft Silverlight negative offset decoding flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows unauthenticated remote code execution, is listed in CISA KEV with known ransomware use, and has a very high EPSS score, though it requires user interaction.

What it is

Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, corrupting object headers. A remote attacker can exploit this through a crafted website to run arbitrary code or cause a denial of service. The flaw is serious because it is remotely reachable and has been exploited in the wild.

Impact

An attacker gains arbitrary code execution in the context of the Silverlight runtime, or can crash it to cause a denial of service. Successful exploitation could lead to full compromise of the affected host.

Attack surface

Reached over the network via a crafted website that triggers the decoding flaw, requiring user interaction (the victim must visit the page or load the content). No authentication or privileges are needed on the target.

Exploitation

Listed in CISA KEV with a 2022-05-25 addition and known ransomware campaign use, and EPSS probability of 0.696 (99.3rd percentile), indicating active exploitation. A vendor patch (MS16-006) is referenced.

What to do

• Apply Microsoft security bulletin MS16-006 to update Silverlight to 5.1.41212.0 or later.
• Since Silverlight is end-of-life, disconnect or remove it from systems where it is no longer required, per CISA guidance.
• Disable or uninstall the Silverlight browser plug-in and block its content from untrusted sites.
• Restrict browsing to trusted sites and enforce network controls to reduce exposure to crafted pages.
• Monitor for and isolate any remaining end-of-life Silverlight installations.

Detection

• Hunt for Silverlight processes (e.g., plugin-container or iexplore loading npctrl.dll) spawning unexpected child processes.
• Monitor for crashes or object-header corruption events in Silverlight runtime logs.
• Detect network requests to sites serving Silverlight (.xap) content from untrusted or newly seen domains.
• Review endpoint telemetry for code execution originating from browser plug-in processes on hosts with Silverlight installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.