CVE-2016-3209: Windows GDI TrueType font parsing bypasses ASLR

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityThe flaw is an ASLR bypass requiring local access and user interaction with no confirmed exploitation, but it affects a very broad product set and carries a high EPSS score.

What it is

Microsoft GDI/GDI+ fails to properly handle TrueType font parsing, allowing an attacker to bypass the ASLR protection mechanism. The flaw is an information disclosure issue (CWE-200) that weakens a core memory-defense, making follow-on exploitation of other bugs more reliable. It affects a wide range of Windows versions plus Office, .NET Framework, Silverlight, Lync and Skype for Business.

Impact

An attacker gains address-layout information that defeats ASLR, which by itself does not execute code but materially improves the reliability of a separate memory-corruption exploit. No confidentiality of user data beyond memory layout is directly exposed.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges needed (PR:N), so the victim must open or render a crafted font or document. The description says remote attackers can trigger it via unspecified vectors, but the record does not specify the exact delivery path.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit or proof-of-concept, so there is no confirmed in-the-wild exploitation in this record. EPSS is high (0.53653, 98.9th percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Apply Microsoft security update MS16-120 for all affected Windows, Office, .NET Framework, Silverlight, Lync and Skype for Business installations.
• Prioritize patching internet-facing and document-processing endpoints where untrusted files are opened.
• Enforce ASLR system-wide and avoid disabling it for applications that process untrusted content.
• Restrict opening of untrusted documents and fonts from email and web downloads through attachment filtering and Mark-of-the-Web controls.

Detection

• Monitor for crashes or abnormal memory-access faults in GDI/font-parsing components (gdi32, gdiplus, fontdrvhost) on endpoints opening documents.
• Hunt for processes loading unusual or malformed font files from temp or download directories.
• Correlate ASLR-bypass indicators with subsequent exploitation attempts in the same process tree.
• Audit endpoints for missing MS16-120 updates via patch-management or vulnerability-scan data.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.