CVE-2016-0092: Windows OLE memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.8 with high EPSS and broad legacy Windows exposure make this a serious remote code execution risk despite no KEV listing.

What it is

Microsoft Windows OLE fails to properly validate input when handling a crafted file, leading to memory corruption that can be exploited for remote code execution. The flaw affects a broad set of legacy Windows versions including Vista, 7, 8.1, RT 8.1, Server 2008, Server 2012, and Windows 10 Gold/1511. It matters because OLE is embedded throughout Windows document handling, so a malicious file can compromise a host without any server-side exposure.

Impact

An attacker who gets a crafted file opened gains arbitrary code execution in the context of the logged-on user. That yields full compromise of confidentiality, integrity, and availability on the affected host.

Attack surface

Reached locally by opening a malicious file that triggers OLE parsing; the CVSS vector is AV:L with UI:R and PR:N, so no credentials are needed but the victim must open or interact with the crafted file. No network service exposure is described.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is 0.58181 (99th percentile), indicating a high modeled likelihood of exploitation activity. Reference tags are empty, so no public exploit or PoC is confirmed by the record.

What to do

• Apply the Microsoft MS16-030 security update for the affected Windows versions as the primary fix.
• Where patching is delayed, restrict opening of untrusted OLE-embedded documents and enforce attachment filtering at mail and web gateways.
• Disable or harden OLE-related components and legacy document handlers that are not required for business use.
• Upgrade end-of-life platforms such as Vista, Windows 7 RTM/SP1, and Server 2008 to supported releases.
• Educate users not to open unexpected documents or attachments from untrusted sources.

Detection

• Monitor for Office or OLE host processes spawning unexpected child processes such as cmd.exe, powershell.exe, or scripting hosts.
• Alert on document files written to temp or user directories followed by process creation from those paths.
• Hunt for crashes or anomalous memory access in OLE-related DLLs and Office applications via endpoint telemetry.
• Review proxy and mail logs for delivery of documents with embedded OLE objects from untrusted senders.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.