CVE-2016-3251

Exploitation likely. EPSS gives it a 58% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.02.8Low EPSS percentile99th58% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-07-13Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your devices run Microsoft Windows Vista Service Pack 2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2008 SP2, Windows Server 2012, Windows Server 2012 R2, or Windows 10 Gold/1511.
Verify that the security update(s) from Microsoft MS16-090 are installed on each affected machine.
If any machine is missing the MS16-090 fix, install the vendor-recommended remediation for MS16-090 and reboot if required.
Re-check access controls so only trusted users can log on locally (since the issue requires local access).

Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address information via a crafted application, aka "Win32k Information Disclosure Vulnerability."

In plain language

Written by AI from the record

This is a Windows security bug that (in some cases) can let a logged-in local user learn internal system memory details; for most small businesses it’s a low-priority issue, but you should still update the affected Windows systems to the fix released in MS16-090.

CVE-2016-3251 is a local information disclosure weakness in the Windows GDI (Win32k) kernel component that can allow a crafted Win32 application to obtain sensitive kernel-address information; fixed via Microsoft’s remediation guidance in MS16-090.

If you're affected

Leaked internal system memory details
Helps attackers plan follow-up attacks
Increased risk from insider/local access
Potential disruption if exploited

What is it

Windows has a drawing/input component called GDI (part of the Windows “kernel-mode” drivers). A bug in it can let a person who already has access to log into the machine locally run a specially made app to learn sensitive internal memory address details. Think of it like giving someone the exact map coordinates of where things sit in the building—useful for planning a deeper break-in later, even if it doesn’t immediately delete or encrypt anything.

Who is affected

This matters if you run Microsoft Windows Vista Service Pack 2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2008 SP2, Windows Server 2012, Windows Server 2012 R2, or Windows 10 Gold/1511. The findings indicate the risk is to “local users,” meaning the attacker needs to have the ability to run code on the device after logging in (it’s not described as a remote-only flaw). Final reachability gate: treat it as a concern when an attacker can already get local access to the affected Windows machine.

How urgent is it

This is GREEN for most small businesses because there’s no confirmation of real-world exploitation in the provided findings (it is not listed in CISA KEV, and no public exploit code is on record). The main reason to act is to close a path that could help someone with local access learn sensitive system memory details; patch through MS16-090 when feasible.

What to do — in detail

Confirm whether you’re exposed

Identify your OS versions on all endpoints and servers.
Compare against the affected set from the findings: Windows Vista Service Pack 2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold/1511.
For each affected machine, check installed security updates for Microsoft MS16-090.

Remediate

If MS16-090 is not installed, install the vendor-provided remediation for MS16-090 on that machine and reboot if the update requires it.
Apply the remediation to both endpoints and any servers in the affected version list.

Compensating controls (if patching is delayed)

Reduce the number of users who can log in locally on the affected systems.
If you have local admin accounts, strongly restrict and monitor their use.
Monitor for unusual local app activity from non-admin users, especially on systems where untrusted users can log in.

What to watch after patching

Ensure the MS16-090 update is actually installed (not just “offered”).
Re-verify user access policies so only trusted people can obtain local execution.

CISA/KEV

Not listed in CISA KEV in the provided findings, so there is no KEV-specific deadline to follow here.

Technical context

CVE-2016-3251 (CWE-200) is an information disclosure issue in the Windows GDI component within kernel-mode drivers (Win32k). The provided technical backstop states that a crafted application can cause disclosure of sensitive kernel-address information; the findings characterize the affected scenario as local users obtaining sensitive kernel-address data. The KEV program does not list this CVE in the provided findings, and there is no public exploit code recorded; therefore the current urgency is driven mainly by patch hygiene rather than confirmed active exploitation. A prediction system indicated elevated likelihood with a rising trend, but public-facing blocks here do not treat that prediction as proof of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

58% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

24 events over 3724 days, from the signal feeds we watch.

2026-09-23EPSS band change0 → highepss band change
2026-09-21EPSS band changehigh → 0epss band change
2026-09-06EPSS band change0 → highepss band change
2026-09-05EPSS band changehigh → 0epss band change
2026-08-31EPSS band change0 → highepss band change
2026-08-29EPSS band changehigh → low

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation
- Windows 10OSOn-premOperating Systems / windows
- Windows 7 Service Pack 1OSOn-premOperating Systems / windows
- Windows 8.1OSOn-premOperating Systems / windows
- Windows RT 8.1OSOn-premOperating Systems / windows
- Windows Server 2008 Service Pack 2OSOn-premOperating Systems / windows
- Windows Server 2012 GoldOSOn-premOperating Systems / windows
- windows vistaOSOperating Systems / windows
- Windows Vista Service Pack 2OSOn-premOperating Systems / windows

And 10 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Scored 2.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability NoneNo availability impact