← Vulnerability feed

Vulnerability record · CVE-2016-0185 · published 11 May 2016

CVE-2016-0185: Microsoft Windows Media Center .mcl File Remote Code Execution

Microsoft · Windows 7

Windows Media Center on Vista SP2, Windows 7 SP1, and Windows 8.1 fails to properly handle a crafted Media Center link (.mcl) file, allowing arbitrary code execution. Because the flaw is reachable through a file a victim opens, it remains a practical risk on any unpatched legacy Windows endpoint where Media Center is present.

7.8 CVSS 3.1 High CISA KEV since 3 Nov 2021 EPSS 70% · top 0.6%
7.8CVSS 3.1 base score, v2 9.3
70%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
3Affected product versions listed by NVD
11References
17 Jun 2026Last modified by NVD

Description

Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a very high EPSS score and public exploit code, but requires user interaction and affects only legacy, largely unsupported Windows versions.

What it is

Windows Media Center on Vista SP2, Windows 7 SP1, and Windows 8.1 fails to properly handle a crafted Media Center link (.mcl) file, allowing arbitrary code execution. Because the flaw is reachable through a file a victim opens, it remains a practical risk on any unpatched legacy Windows endpoint where Media Center is present.

Impact

An attacker who gets a victim to open a malicious .mcl file can execute arbitrary code in the context of the logged-on user, giving full control of confidentiality, integrity, and availability on that host.

Attack surface

Reached locally by opening a crafted .mcl file; the CVSS vector shows no privileges required but user interaction required, so the victim must open the file or link. No network service exposure is described.

Exploitation

It is listed in CISA KEV (added 2021-11-03), and EPSS is very high at roughly 0.70 (99th percentile), with a public Exploit-DB entry referenced, indicating known exploitation activity.

What to do

  • Apply the Microsoft MS16-059 security update on all affected Windows Vista SP2, Windows 7 SP1, and Windows 8.1 systems.
  • Remove or disable Windows Media Center where it is not required, since these platforms are out of support.
  • Block or quarantine .mcl file attachments and downloads at email and web gateways.
  • Restrict user ability to open untrusted file types via application control or file association hardening.
  • Prioritize migration off end-of-life Windows versions that cannot receive current patches.

Detection

  • Monitor process creation for wmc.exe or Media Center processes spawned from user download or temp directories.
  • Alert on .mcl file creation or execution events in endpoint telemetry.
  • Hunt for suspicious child processes (script interpreters, cmd, powershell) launched by Media Center binaries.
  • Review email and web proxy logs for .mcl attachments or downloads reaching affected hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2016-0185 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Microsoft Windows Media Center Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/90023 Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1035832 Broken LinkThird Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-277 Third Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-059 PatchVendor Advisory
https://www.exploit-db.com/exploits/39805/ Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/90023 Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1035832 Broken LinkThird Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-277 Third Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-059 PatchVendor Advisory
https://www.exploit-db.com/exploits/39805/ Third Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0185 US Government Resource

Track CVE-2016-0185 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-0708Microsoft Remote Desktop Services use-after-free remote code executionRemote Desktop Services (formerly Terminal Services) contains a use-after-free flaw that lets an unauthenticated attacker execute code by sending spe…KEVEPSS 100%analysed9.8CVE-2017-8543Windows Search memory handling flaw allows remote code executionWindows Search fails to properly handle objects in memory, allowing an unauthenticated remote attacker to execute code on affected Windows systems. T…KEVEPSS 74%analysed9.8CVE-2015-1635Microsoft HTTP.sys remote code execution via crafted HTTP requestsHTTP.sys in multiple Windows versions fails to properly handle crafted HTTP requests, allowing remote code execution. The flaw is reachable over the …KEVEPSS 100%analysed9.8CVE-2008-4250Microsoft Windows Server service RPC path canonicalization buffer overflowThe Server service in multiple Windows versions fails to properly handle path canonicalization, allowing a crafted RPC request to overflow a buffer a…KEVEPSS 99%analysed8.8CVE-2022-41128Windows Scripting Languages out-of-bounds write allows remote code executionCVE-2022-41128 is an out-of-bounds write (CWE-787) in Windows Scripting Languages that leads to remote code execution. Microsoft rates it 8.8 HIGH wi…KEVEPSS 25%analysed8.8CVE-2022-26923Microsoft Active Directory Domain Services certificate validation privilege escalationActive Directory Domain Services fails to properly validate certificate attributes, allowing a low-privileged domain user to obtain a certificate tha…KEVEPSS 84%analysed8.8CVE-2021-40444Microsoft MSHTML remote code execution via malicious Office documentCVE-2021-40444 is a remote code execution flaw in the MSHTML browser rendering engine on Microsoft Windows. An attacker can embed a malicious ActiveX…KEVEPSS 97%analysed8.8CVE-2020-1020Windows Adobe Type Manager Library font parsing out-of-bounds write RCEMicrosoft Windows Adobe Type Manager Library mishandles a specially crafted multi-master font in Adobe Type 1 PostScript format, causing an out-of-bo…KEVEPSS 65%analysed

Source: NIST National Vulnerability Database (record CVE-2016-0185), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.