CVE-2016-3304: Windows font library input validation flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh CVSS impact and a very high EPSS percentile with public exploit code, though exploitation requires user interaction and no KEV listing exists.

What it is

The Windows font library fails to properly validate crafted embedded fonts, allowing remote code execution. It affects a wide range of Windows versions plus Office, Word Viewer, Skype for Business, Lync and Live Meeting. Because fonts are processed automatically in many document and messaging workflows, the flaw matters for both endpoint and collaboration software.

Impact

An attacker who gets a crafted embedded font processed can execute arbitrary code in the context of the affected application or user. CVSS 3.0 rates confidentiality, integrity and availability impact as high.

Attack surface

Reached locally with user interaction required (CVSS vector AV:L/UI:R), typically by opening or previewing a document, message or other content containing a crafted embedded font. No privileges are required (PR:N), but the victim must trigger processing of the malicious font.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.505 (98.9th percentile) and a public Exploit-DB entry (40257) exists, indicating exploit code is publicly available.

What to do

• Apply Microsoft security update MS16-097 for the affected Windows, Office, Lync, Skype for Business and Live Meeting products.
• Disable or restrict embedded font processing in Office and messaging clients where feasible.
• Block or strip embedded fonts from untrusted documents and messages at email and web gateways.
• Upgrade or retire unsupported platforms such as Windows Vista, Windows Server 2008 and Office 2007 that no longer receive fixes.

Detection

• Monitor for Office, Word Viewer, Lync, Skype for Business or Live Meeting processes spawning unexpected child processes such as cmd.exe or powershell.exe.
• Alert on crashes or abnormal behavior in font-related components (e.g., fontdrvhost, gdi32, win32k) when opening documents or messages.
• Hunt for documents and messages containing embedded fonts arriving from external or untrusted senders.
• Review endpoint telemetry for known Exploit-DB 40257 exploitation patterns against affected applications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.