CVE-2016-1606: Micro Focus Rumba COM Objects Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and high EPSS percentile make this a critical remote code execution risk despite no KEV listing.

What it is

Micro Focus Rumba 9.4.x before 9.4 HF 13960 contains multiple stack-based buffer overflows in COM objects across iconfig.dll, ProfEdit.dll, FtxBIFF.dll, NMSecComParams.dll, and FTPSftp.dll. Each flaw is triggered by an overlong string passed to a specific property or function, such as NetworkName, CPName, PrinterName, WriteRecords Data, Serialized, UserName, LUName, or the FTP Host field. Because the vulnerable components are reachable over the network without authentication, this is a serious remote code execution risk for exposed Rumba deployments.

Impact

A remote attacker can execute arbitrary code in the context of the Rumba process, leading to full compromise of confidentiality, integrity, and availability on the affected host. No user privileges are required beyond the ability to reach the vulnerable COM interface.

Attack surface

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaws are reachable over the network with no authentication and no user interaction. The description lists COM object properties and functions, so an attacker would send crafted values to those interfaces, likely through Rumba's network-facing services or file transfer components.

Exploitation

CVE-2016-1606 is not listed in CISA KEV, but EPSS shows a 30-day probability of 0.4555 (98.7th percentile), indicating a high likelihood of exploitation activity. The references include Zero Science Lab and CXSecurity advisories, which typically publish proof-of-concept details, though no active exploitation is confirmed by the record.

What to do

• Apply Micro Focus Rumba 9.4 HF 13960 or later, which the vendor states fixes these stack buffer overflows.
• If patching is not immediately possible, restrict network access to Rumba COM interfaces and FTP services to trusted hosts only.
• Disable or block the FTP client and any unnecessary COM automation features until the patch is applied.
• Monitor vendor advisories and apply any subsequent Rumba security updates as they become available.

Detection

• Monitor for unusually long strings or malformed input sent to Rumba COM object properties such as NetworkName, CPName, PrinterName, Serialized, UserName, LUName, or the FTP Host field.
• Inspect process memory or crash dumps for Rumba-related DLLs (iconfig.dll, ProfEdit.dll, FtxBIFF.dll, NMSecComParams.dll, FTPSftp.dll) showing stack buffer overflow patterns.
• Use network monitoring to detect anomalous FTP or COM traffic targeting Rumba hosts, especially oversized fields or unexpected binary payloads.
• Review endpoint logs for Rumba process crashes or unexpected child processes spawned by Rumba, which may indicate exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.