CVE-2016-0034
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrar… (CVE-2016-0034)
Description
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2016-0034 carries CISA's "Known Ransomware Campaign Use" flag, confirming it has been embedded in active ransomware attack chains — not merely proof-of-concept exploitation. The EPSS score of 69.6 % (99.3rd percentile) places it among the most consistently exploited vulnerabilities tracked, making deprioritisation difficult to justify. The CVSS v3 vector (AV:N/AC:L/PR:N/UI:R, score 8.8) reflects a low-complexity drive-by scenario: an attacker needs only to lure a user to a crafted web page — no prior access or elevated privileges required. For NIS2-scoped organisations, any internet-connected system running unpatched Silverlight 5 below version 5.1.41212.0 must be treated as critically exposed. Because Silverlight is operationally obsolete in most environments, full removal should be preferred over patching alone.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the patch: Update Microsoft Silverlight 5 to version 5.1.41212.0 or later. The fix is shipped in Microsoft Security Bulletin MS16-006 (KB3126036). Prioritise deployment via WSUS, SCCM, or Intune.
- Disable the Silverlight plugin: Immediately disable or block the Silverlight plugin in all browsers (Internet Explorer, Edge Legacy, Firefox, Chrome) via Group Policy until the patch is fully deployed.
- Isolate unpatched workstations: Systems actively running Silverlight that cannot be patched immediately should be disconnected from the internet or moved into a restricted VLAN.
- Enforce Click-to-Play: Use GPO to set
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settingsto require user interaction before any plugin content executes, preventing silent Silverlight execution. - Activate proxy/web filtering: Block known malvertising and drive-by domains at the proxy layer; enable HTTPS inspection on end-user segments to detect crafted Silverlight payloads in transit.
Runbook · Step 2
Mitigation layers
- Network segmentation: Restrict outbound browsing from end-user workstations to approved web categories only; block connections to unknown or newly registered domains at the firewall/proxy level.
- WAF/IPS rule: Deploy a Suricata/Snort rule alerting on
.xapfile downloads and HTTP responses withContent-Type: application/x-silverlight-apporiginating from non-approved sources; keep the alert threshold low. - Application whitelisting: Configure AppLocker or Windows Defender Application Control (WDAC) to prevent
npctrl.dllfrom loading within browser processes where Silverlight is not operationally required. - Least privilege: Ensure browser processes run under standard user accounts — no local administrator rights for end users. This breaks exploit chains that depend on privilege escalation after initial code execution.
- Exploit protection: Enable Windows Defender Exploit Protection settings (DEP, ASLR, CFG) for
iexplore.exe,firefox.exe,chrome.exe, andnpctrl.dllto raise the exploitation bar. - Full removal: If Silverlight is no longer operationally required — which is the case in most modern environments — uninstall it entirely via software distribution. This is the most durable remediation.
Runbook · Step 3
Detection rules
- Sysmon EID 7 (Image Loaded): Alert when
npctrl.dllis loaded by a browser process (iexplore.exe,firefox.exe,chrome.exe) and the DLL file version is below5.1.41212.0.Sigma-Shape: EventID=7 | ImageLoaded contains 'npctrl.dll' | FileVersion < '5.1.41212.0' - Sysmon EID 1 / Windows EID 4688 (Process Creation): Monitor for suspicious child processes spawned directly by browser processes — particularly
cmd.exe,powershell.exe,wscript.exe, ormshta.exeas direct children ofiexplore.exeorfirefox.exe.KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("iexplore.exe","firefox.exe") and FileName in~ ("cmd.exe","powershell.exe","wscript.exe") - Proxy/web logs: Log and alert on HTTP responses with
Content-Type: application/x-silverlight-appor.xapdownloads from external, uncategorised sources. - EDR process tree: Build a SIEM correlation rule for the shellcode-typical chain: browser process →
npctrl.dll→ outbound network connection (Sysmon EID 3) within a short time window. - Windows EID 1000/1001 (Application Crash): Repeated browser crashes with
npctrl.dlllisted as the faulting module may indicate failed exploitation attempts — include as a low-confidence indicator in SIEM correlation.
Metrics
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
microsoft
silverlight5.0 – 5.1.41212.0
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.