Vulnerability record · CVE-2016-0117 · published 9 March 2016
CVE-2016-0117: Windows PDF library input validation flaw enables remote code execution
Microsoft · Windows 10
The PDF library in several Microsoft Windows versions fails to properly validate input, allowing a crafted PDF document to trigger remote code execution. Because PDFs are commonly opened from email, web downloads and shared drives, a successful attack can compromise a workstation with the privileges of the logged-on user.
Description
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability."
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 3.0 base score is 7.8 (HIGH) with full confidentiality, integrity and availability impact, and EPSS is in the 99.4th percentile despite no KEV listing.
What it is
The PDF library in several Microsoft Windows versions fails to properly validate input, allowing a crafted PDF document to trigger remote code execution. Because PDFs are commonly opened from email, web downloads and shared drives, a successful attack can compromise a workstation with the privileges of the logged-on user.
Impact
An attacker who gets a victim to open a malicious PDF can execute arbitrary code in the context of the current user, leading to full compromise of confidentiality, integrity and availability on that host.
Attack surface
Reached locally by opening a crafted PDF document; the CVSS vector shows AV:L, PR:N and UI:R, so no authentication is required but user interaction (opening the file) is needed.
Exploitation
Not listed in CISA KEV and no reference tags indicate a public exploit, but EPSS is very high (0.72934, 99.4th percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Apply the Microsoft security update for MS16-028 (March 2016) on all affected Windows versions.
- Upgrade or migrate off unsupported Windows 8.1, RT 8.1, Server 2012 and Windows 10 Gold/1511 builds.
- Block or sandbox untrusted PDF attachments and downloads at the email and web gateway.
- Configure the default PDF handler to open documents in a sandboxed or protected viewer rather than the Windows PDF library.
- Enforce least privilege so users do not browse or open documents with administrative rights.
Detection
- Monitor process creation for PDF readers spawning unexpected child processes such as cmd.exe, powershell.exe or script hosts.
- Alert on PDF files written to temp or user download directories followed by unusual process execution.
- Review Windows event logs and EDR telemetry for anomalous code execution originating from PDF viewer processes.
- Hunt for known malicious PDF indicators and hash matches in email and endpoint logs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-0117 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-0117), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
