CVE-2016-3357: Microsoft Office memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution in widely used Office products with public exploit code and very high EPSS, though it requires user interaction to trigger.

What it is

A memory corruption flaw (CWE-119) in multiple Microsoft Office, Word, SharePoint and Office Web Apps components lets a crafted document trigger arbitrary code execution. Because the affected software is widely deployed and documents are routinely exchanged, a successful exploit gives an attacker code execution in the context of the opening user.

Impact

An attacker who gets a victim to open a malicious document can execute arbitrary code with the privileges of that user, potentially leading to full system compromise.

Attack surface

Reached locally through a crafted document opened by the user; the CVSS vector shows AV:L, PR:N and UI:R, so no authentication is needed but user interaction (opening the file) is required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.54809 (98.9th percentile) and a public Exploit-DB entry (40406) exists, indicating exploit code is publicly available and exploitation is plausible.

What to do

• Apply the Microsoft security update MS16-107 for all affected Office, Word, SharePoint and Office Web Apps products.
• Disable or restrict opening of untrusted documents and block risky file types at email and web gateways.
• Enable Protected View and Office macro/ActiveX hardening for documents from external sources.
• Segment and restrict SharePoint and Office Web Apps server roles to reduce lateral exposure.
• Monitor for and remove unsupported versions such as Office 2007 and Word Viewer where possible.

Detection

• Hunt for Office processes (WINWORD.EXE, EXCEL.EXE, etc.) spawning child processes such as cmd.exe or powershell.exe.
• Monitor for unusual document opens followed by network connections or file writes from Office applications.
• Review endpoint logs for crashes or memory corruption indicators in Office binaries around document opening.
• Search email and file-share logs for documents matching known exploit samples or unusual embedded objects.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.