CVEvulnerability

CVE-2016-3298

6.5 MEDIUM Known exploited Published 2016-10-14 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability — Microsoft Internet Explorer

An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.

Added to KEV
2022-05-24
Remediation due
2022-06-14
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-3298
Status
Analyzed
Published
2016-10-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N

Description

Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

Affected configurations

• microsoft internet explorer 9 • microsoft internet explorer 10 • microsoft internet explorer 11 • microsoft windows 7 • microsoft windows server 2008 • microsoft windows server 2008 r2 • microsoft windows vista

References