CVE-2016-0092

Exploitation likely. EPSS gives it a 57% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.07.8High EPSS percentile99th57% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-03-09Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any computers run Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold or 1511, or the listed Windows Server releases.
Install the security updates recommended in Microsoft Security Bulletin MS16-030; the findings do not provide a single fixed Windows version.
Until updated, block or quarantine unexpected document attachments and files from untrusted sources.
Ask IT to investigate any suspicious file opened on an affected computer.

Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0091.

In plain language

Written by AI from the record

This affects older supported-at-the-time Windows releases from Windows Vista SP2 through Windows 10 version 1511; act if any of those systems still open email attachments or shared files.

Windows OLE input-handling flaw (CWE-20) permits arbitrary code execution when a victim opens or processes a crafted OLE file.

If you're affected

Full computer takeover
Business file theft
Ransomware installation
Operational disruption
Fraudulent email access

What is it

Windows can mishandle a specially prepared file and let it run an attacker’s instructions when someone opens or processes it. It is like a document arriving with a hidden master key that can give a criminal control of the computer that opened it.

Who is affected

This matters if you run the Windows operating system on the older releases named above, including workstations or servers that handle attachments and shared documents. An attacker does not need an account, but someone must open or process the crafted file.

How urgent is it

Treat this as an amber priority because the flaw can give an attacker control of a computer after a malicious file is opened. It is not listed in CISA’s catalog of vulnerabilities known to be actively exploited, and no public exploit code is on record, but affected legacy systems should be addressed promptly.

What to do — in detail

Confirm installed Windows editions and versions with your device-management inventory or winver, then identify systems that can open or process files received by email, downloads, or file shares. Apply the updates recommended by Microsoft Security Bulletin MS16-030 through your normal Windows update process; the available findings do not identify a single fixed version or separate fixed versions by release branch. Because these releases are legacy, plan an operating-system upgrade where vendor support has ended. If patching is delayed, restrict untrusted attachments and document files, especially on email-facing and shared-use systems, and isolate affected systems from sensitive network resources where practical. No CISA KEV remediation due date applies. Review endpoint security alerts and email/file gateway records for suspicious documents opened on affected devices.

Technical context

Severity is CVSS 7.8 High (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-20 input validation weakness in Windows OLE handling enables arbitrary code execution after a crafted OLE file is opened or processed; authentication is not required and user interaction is required. CISA KEV does not list CVE-2016-0092, and no public exploit code is recorded. EPSS predicts 57.3% likelihood at the 99th percentile, with a rising trend; this is predictive rather than confirmed exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

57% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

24 events over 3850 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation
- Windows 10 1511OSOn-premOperating Systems / windows
- Windows 7 Service Pack 1OSOn-premOperating Systems / windows
- Windows 8.1OSOn-premOperating Systems / windows
- Windows RT 8.1OSOn-premOperating Systems / windows
- Windows Server 2008 Service Pack 2OSOn-premOperating Systems / windows
- Windows Server 2012 GoldOSOn-premOperating Systems / windows
- windows vistaOSOperating Systems / windows
- Windows Vista Service Pack 2OSOn-premOperating Systems / windows

And 10 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable