CVE-2016-0100 : Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which

Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."

Published 2016-03-09 11:59:11

Updated 2025-04-12 10:46:41

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2016-0100

Microsoft » Windows Vista » Update SP2
cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Update SP2
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-0100

EPSS FAQ

69.61%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2016-0100

Office OLE Multiple DLL Side Loading Vulnerabilities

Disclosure Date: 2015-12-08

First seen: 2020-04-26

exploit/windows/fileformat/office_ole_multiple_dll_hijack

Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the curr

More information

CVSS scores for CVE-2016-0100

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.4	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-0100

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)
CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-0100

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-025

Microsoft Security Bulletin MS16-025 - Important | Microsoft Docs
http://www.securitytracker.com/id/1035205

Microsoft Windows Library Loading Input Validation Flaw Lets Local Users Gain Elevated Privileges - SecurityTracker
http://www.securityfocus.com/bid/83930

Microsoft Windows Library Loading CVE-2016-0100 Remote Code Execution Vulnerability

Jump to