CVE-2016-1464

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.07.8High EPSS percentile95th10.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2016-09-03Updated 2026-05-06Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your staff machines use Cisco WebEx Meetings Player T29.10.
In that player, confirm whether “WRF file support” is enabled.
If WRF support is enabled and you have T29.10, update to Cisco’s fixed remediation from the Cisco Security Advisory.
Until updated, do not open WRF files from unexpected sources and avoid running any WebEx player content that comes from unknown senders.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code via a crafted file, aka Bug ID CSCva09375.

In plain language

Written by AI from the record

CVE-2016-1464 is a vulnerability in Cisco WebEx Meetings Player T29.10 that can let someone run code if you open a specially made file when WRF support is enabled, so small businesses should treat it as a likely-to-matter “be careful” risk if you use this player.

CVE-2016-1464 is an arbitrary code execution issue in Cisco WebEx Meetings Player T29.10 when WRF file support is enabled; an attacker can trigger it by getting a victim to open a crafted file (public exploit exists).

If you're affected

Malware running on your computer
Takeover of affected employee machines
Disruption of meetings and work
Compromise of local business data

What is it

This flaw is like a “dangerous file opening” problem in a meeting viewer: if WRF support is turned on, a specially made file can trick a device into running attacker code. It doesn’t usually matter unless someone can get your staff to open that crafted file, but if it happens it can lead to malware control of the affected computer.

Who is affected

You should care if your small business uses Cisco WebEx Meetings Player T29.10 on employee devices. This is relevant specifically when WRF file support is enabled and a user is induced to open a crafted WRF file. There’s no risk unless the vulnerable player is in use and the attacker’s file is reachable to a user through normal “open this file” behavior (it’s not a purely automatic background risk).

How urgent is it

This is an AMBER issue because a public exploit exists and the likelihood signals are trending upward. While it still requires a user to open a crafted file with WRF support enabled, once attackers have a workable exploit, affected organizations should fix this promptly.

What to do — in detail

Inventory / confirm exposure

Identify whether any endpoints (desktops/laptops) have Cisco WebEx Meetings Player T29.10 installed and in use.
On each affected machine, verify whether “WRF file support” is enabled in the player.

Determine the right fix

Use Cisco’s remediation guidance from the Cisco Security Advisory referenced by the vendor (cisco-sa-20160831-meetings-player).
Upgrade/replace the Meetings Player so that the vulnerable T29.10 configuration (with WRF support enabled) is no longer present.

If you can patch now

Apply Cisco’s recommended remediation immediately, then re-check that the version/configuration is corrected.

Temporary workaround if patching is delayed

Disable WRF file support in the player if possible.
Enforce a simple rule for staff: do not open WRF files from unexpected senders (especially email attachments, links, or files received via chat).

What to monitor

Watch endpoint security logs for detections triggered after opening meeting/player-related files from untrusted sources.
If you use a security tool, review alerts for suspicious process creation immediately following file opens tied to WebEx player activity.

Technical context

Severity is rated high (CVSS 7.8) with local attacker characteristics, but exploitation is driven by user interaction: a user must open a crafted file. The weakness is CWE-20 (improper input validation / code execution via crafted input). Findings indicate weaponization with at least one known public exploit and rising press attention; KEV is not listed, so this is not confirmed as mass-exploited via CISA KEV. EPSS is a prediction (and rising), but public exploit availability and the vulnerability’s ability to run arbitrary code increase practical risk. WRF file support must be enabled in Cisco WebEx Meetings Player T29.10 for the attack path described in the findings to apply.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10.0% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 61 days before the patch.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → lowepss band change
2026-09-05EPSS band changelow → moderateepss band change
2026-08-31EPSS band changemoderate → lowepss band change
2026-08-29EPSS band changelow → moderate

Affected products

ciscocommercial · USaka cisco systems inc., cisco systems
- webex wrf player t29Networking Infrastructure

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable