CVE-2016-3313: Microsoft Office and Word memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution in widely deployed document software with public exploit code and high EPSS, though no KEV listing or known ransomware use.

What it is

A memory corruption flaw (CWE-119) in Microsoft Office 2007 through 2016, Word 2016 for Mac, and Word Viewer lets a remote attacker run arbitrary code when a crafted file is opened. Because the affected products are common document handlers, a malicious file delivered to a user can compromise the host.

Impact

An attacker who gets a victim to open the crafted file can execute arbitrary code in the context of the user, giving full control of confidentiality, integrity and availability on that system.

Attack surface

Reached locally through a crafted file opened in the affected Office or Word product; the CVSS vector shows no privileges required but user interaction is required to open the document.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.498, ~98.8th percentile) and a public Exploit-DB entry (40224) exists, indicating exploit code is available.

What to do

• Apply the Microsoft MS16-099 security update for the affected Office, Word and Word Viewer versions.
• Disable or restrict opening of untrusted Office documents, especially from email and web downloads.
• Use Office Protected View and block macros/active content for files from external sources.
• Retire unsupported versions such as Office 2007 and Word Viewer where feasible.

Detection

• Monitor for Office or Word processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on document files written to temp or user directories immediately before Office process execution.
• Review endpoint logs for crashes or memory corruption events in WINWORD.EXE or related Office binaries.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.