CVE-2016-3303: Windows font library input validation flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityA public exploit exists and EPSS is very high, but exploitation requires local user interaction to open a crafted file, keeping it below critical.

What it is

The Windows font library fails to properly validate crafted embedded fonts, allowing memory corruption that can lead to arbitrary code execution. The flaw affects a wide range of Microsoft products including Windows Vista through Windows 7, Windows Server 2008, Office 2007/2010, Word Viewer, Skype for Business 2016, Lync, and Live Meeting. It is a distinct vulnerability from CVE-2016-3304.

Impact

An attacker who successfully exploits this can execute arbitrary code in the context of the current user. Because the CVSS vector shows high confidentiality, integrity, and availability impact, a full compromise of the affected process and potentially the host is possible.

Attack surface

The CVSS vector is local with user interaction required (AV:L/UI:R), meaning the victim must open or render a crafted document or font file. No privileges are required (PR:N), so any user who processes the malicious content can trigger it.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.505 (98.9th percentile), and a public Exploit-DB entry (40256) exists, indicating exploit code is available. No ransomware associations are documented.

What to do

• Apply Microsoft security bulletin MS16-097 for the affected Windows, Office, Lync, Skype for Business, and Live Meeting components.
• Disable or restrict embedded font rendering in Office and Windows where feasible until patching is complete.
• Block untrusted font files and documents from external sources at email and web gateways.
• Run affected applications with least privilege and enable exploit mitigation features such as DEP and ASLR.
• Inventory all listed products, including legacy Lync, Live Meeting, and Word Viewer, since they may be overlooked in patch cycles.

Detection

• Monitor for processes such as WINWORD.EXE, EXCEL.EXE, LYNC.EXE, or OCSMEET.EXE spawning unexpected child processes or making unusual network connections.
• Hunt for Office or Lync documents containing embedded font resources that originate from external or untrusted sources.
• Review endpoint telemetry for crashes or memory corruption in font-related DLLs (e.g., gdi32.dll, fontdrvhost.exe) following document or font rendering.
• Search for known Exploit-DB 40256 indicators or related shellcode patterns in file and memory scans.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.