CVE-2016-3235: Microsoft Visio and Visio Viewer OLE DLL side-loading privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8, CISA KEV listing and a high EPSS percentile indicate active exploitation risk, though the attack requires local access and user interaction.

What it is

Microsoft Visio 2007 SP3, 2010 SP2, 2013 SP1, 2016 and Visio Viewer 2007 SP3/2010 mishandle library loading, allowing a crafted application to load an attacker-controlled DLL. Because the flaw is in a widely deployed Office component and is listed in CISA KEV, it matters to any environment still running these versions.

Impact

An attacker who can place a malicious DLL and get a user to open a crafted file or application gains code execution in the context of the victim, potentially escalating privileges on the local system.

Attack surface

Reached locally: the CVSS vector is AV:L with UI:R and PR:N, so the attacker needs local access or a way to plant a file and must rely on user interaction to trigger the load. No authentication is required.

Exploitation

CVE-2016-3235 is in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.434 (98.7th percentile), and a reference is tagged Exploit, indicating public exploit material exists.

What to do

• Apply the Microsoft MS16-070 update for all affected Visio and Visio Viewer versions.
• Remove or upgrade unsupported Visio 2007/2010/2013 installations that cannot be patched.
• Restrict write access to application and working directories so untrusted users cannot drop DLLs where Visio loads them.
• Block untrusted Visio and OLE documents at email and web gateways, and disable OLE object activation where not needed.
• Monitor KEV remediation deadlines and confirm patched status across endpoints.

Detection

• Alert on Visio or Visio Viewer processes loading DLLs from user-writable paths such as Downloads, Temp or Desktop.
• Hunt for unexpected DLL files written next to Visio executables or in the same directory as opened Visio documents.
• Review process creation where visio.exe or the Visio Viewer spawns child processes such as cmd.exe or powershell.exe.
• Correlate file-write events in user directories with subsequent Visio process starts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.