CVE-2016-3298: Internet Explorer and Windows Messaging API file existence disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is listed in CISA KEV with a high EPSS percentile, but the impact is limited to information disclosure with required user interaction.

What it is

Internet Explorer 9 through 11 and the Internet Messaging API on Windows Vista SP2, Server 2008 SP2/R2 SP1 and Windows 7 SP1 let a remote attacker determine whether arbitrary files exist on the target. The flaw is an information disclosure issue, so it leaks local file presence rather than executing code, but that reconnaissance can support follow-on attacks.

Impact

An attacker learns whether specific files exist on the victim host, exposing system configuration and installed-software details useful for planning later exploitation. No code execution, privilege escalation or data modification is described.

Attack surface

Reached over the network via a crafted web site viewed in Internet Explorer or through the Internet Messaging API; the CVSS vector shows no privileges required but user interaction is required (UI:R), so the victim must open the page or message.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-24 with a 2022-06-14 remediation due date, and EPSS gives a 30-day probability of 0.3279 (98.3rd percentile), indicating observed exploitation and elevated likelihood. No ransomware campaign use is recorded.

What to do

• Apply the Microsoft updates referenced in security bulletins MS16-118 and MS16-126, which cover Internet Explorer and the Windows Internet Messaging API.
• Retire or migrate off Internet Explorer 9-11 and the affected legacy Windows versions (Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1), which are out of support.
• Restrict browsing to trusted sites and block untrusted content through network or proxy filtering to reduce exposure to crafted pages.
• Enforce attachment and link handling controls in messaging clients to limit delivery of crafted content to the Internet Messaging API.

Detection

• Monitor for Internet Explorer or messaging client processes accessing unusual file paths, which may indicate file-existence probing.
• Alert on known exploit or proof-of-concept signatures tied to this CVE at network and endpoint layers.
• Review proxy and DNS logs for access to low-reputation or newly registered sites delivering crafted content to IE.
• Track hosts still running IE 9-11 or the affected Windows versions and prioritize them for patching or isolation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.