CVE-2016-7286: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with high confidentiality, integrity and availability impact, public exploit code available, and very high EPSS, though user interaction and a legacy unsupported browser reduce real-world reach.

What it is

The scripting engines in Microsoft Edge contain a memory corruption flaw (CWE-119) that can be triggered by a crafted web site, allowing remote attackers to execute arbitrary code or cause a denial of service. It is one of several similar scripting engine memory corruption issues patched in the same Microsoft update.

Impact

An attacker who successfully triggers the flaw can execute arbitrary code in the context of the Edge process or crash the browser, giving code execution or denial of service on the victim's machine.

Attack surface

Reached over the network via a crafted web site rendered in Microsoft Edge; no authentication is required, but the CVSS vector indicates user interaction (UI:R) is needed, meaning the victim must visit or open the malicious page.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.68884, 99.3rd percentile) and public exploit code exists on Exploit-DB (40947) and Packet Storm, indicating known public exploitation techniques.

What to do

• Apply the Microsoft security update MS16-145 (December 2016) that addresses this scripting engine vulnerability.
• Upgrade to a supported, fully patched version of Microsoft Edge or a current browser, since Edge legacy is no longer supported.
• Enforce browser isolation or application allowlisting to reduce exposure to untrusted web content.
• Block or restrict access to known exploit-hosting and untrusted sites via web filtering and network controls.
• Enable exploit protection features such as Microsoft Defender Exploit Guard / ACG where feasible.

Detection

• Monitor for Edge process crashes or abnormal terminations that may indicate memory corruption attempts.
• Hunt for network connections to known exploit-hosting domains or URLs referenced in public exploit code.
• Use endpoint detection to flag suspicious child processes spawned by Microsoft Edge (e.g., cmd.exe, powershell.exe).
• Review proxy and DNS logs for access to sites hosting the published PoC/exploit for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.