CriticalCVE-2016-3235

    Microsoft Office OLE DLL Side Loading Vulnerability (CVE-2016-3235)

    Published In CISA KEV since Sources: CVE.org

    What is affected, what to do

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

    The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Microsoft Visio eq 2007..2007
    • Microsoft Visio eq 2010..2010
    • Microsoft Visio eq 2013..2013
    • Microsoft Visio eq 2016..2016
    • Microsoft Visio Viewer eq 2007..2007
    • Microsoft Visio Viewer eq 2010..2010

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    7.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    7.8

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: CVE.org

    43.3 %

    EPSS score

    Elevated — model estimates 10-50% exploitation likelihood.

    Source: FIRST EPSS, percentile 98.7

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    216.97 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    7.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    7.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    43.3 %
    Elevated — model estimates 10-50% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    98.7
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · not automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 10 February 2025

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This is a classic DLL side-loading flaw. A user opens a crafted Visio file, Visio loads an attacker-controlled DLL from the same directory, and the attacker gets code execution in the user's context. No prior authentication is needed, but user interaction is. Exploitation likelihood is very high, placing it among the CVEs most likely to be exploited, although CISA has not flagged ransomware use. Likely targets are organisations whose engineering, OT planning or network documentation teams use Visio heavily and exchange diagrams with external parties — a profile common among KRITIS operators. Treat it as medium priority where Visio is fully patched and no legacy versions remain. Treat it as high priority wherever out-of-support Visio builds or unrestricted outbound SMB/WebDAV exist.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Inventory: Enumerate all endpoints running Visio 2007 SP3, 2010 SP2, 2013 SP1 or 2016, and Visio Viewer 2007 SP3/2010. Use software inventory, Intune/SCCM, or an EDR query for VISIO.EXE and VPREVIEW.EXE. Visio Viewer is easy to miss because it ships as a browser component.
      • Patch: A patch is available from the vendor; look up the exact version and KB numbers in the Microsoft advisory for CVE-2016-3235. Confirm the patch state via WSUS/SCCM compliance reporting, not just deployment success.
      • Retire out-of-support versions: Visio 2007, 2010 and 2013 are out of vendor support. Uninstall them or migrate users to a supported release. Until that is done, flag those hosts as high-risk assets in the risk register.
      • Block outbound SMB/WebDAV: Block TCP 445/139 and WebDAV (the WebClient service, and HTTP/HTTPS to non-approved destinations) from clients at the perimeter. A common delivery path is a crafted Visio file on a remote share with a malicious DLL sitting next to it.
      • Short-term user advisory: Tell users not to open .vsd/.vsdx/.vdx files from ZIP archives, network shares or untrusted email attachments when .dll files sit in the same folder.

    2. Runbook step 2

      Mitigation layers

      • Configuration (DLL search path): Deploy the registry value CWDIllegalInDllSearch via GPO under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager. Setting it to 0xFFFFFFFF removes the current working directory from DLL search. Also ensure SafeDllSearchMode is not disabled. Pilot this first, because some line-of-business applications may break.
      • Endpoint hardening (application control): Enforce WDAC or AppLocker DLL rules that block library loads from user-writable paths such as %USERPROFILE%, %TEMP%, Downloads and mapped drives. Outside %ProgramFiles% and %WINDIR%, allow only signed DLLs.
      • Endpoint hardening (ASR): Set the Defender ASR rules "Block Office applications from creating executable content" and "Block Office applications from injecting code into other processes" to block mode.
      • Network segmentation: Disable the WebClient service on clients where WebDAV is not a business requirement. Restrict client SMB traffic to approved internal file servers only, using a host firewall rule pushed via GPO.
      • Mail/web gateway: Quarantine or sandbox archives (.zip, .rar, .iso) that contain both Visio files and .dll files. Detonate Visio attachments from external senders in a sandbox before delivery.
      • IAM/least privilege: Remove local admin rights from Visio users. This limits privilege gain and persistence after a successful side-load.

    3. Runbook step 3

      Detection rules

      • Sysmon EID 7 (Image Loaded): Image ends with \VISIO.EXE or \VPREVIEW.EXE and ImageLoaded sits outside C:\Windows\ or C:\Program Files*. Prioritise hits where Signed=false. Sigma shape: selection: Image|endswith: ['\VISIO.EXE','\VPREVIEW.EXE'] with filter: ImageLoaded|startswith: ['C:\Windows\','C:\Program Files'].
      • EDR process ancestry (Sysmon EID 1 / Event ID 4688): VISIO.EXE spawning cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe or wscript.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "visio.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","regsvr32.exe","mshta.exe")
      • Sysmon EID 11 (FileCreate): .dll files written into the same directory as a recently opened or extracted Visio file, especially under \Downloads\, \Temp\ or archive extraction paths.
      • Network telemetry (Zeek/Suricata): Outbound SMB (smb_files.log, smb_mapping.log) or WebDAV traffic (PROPFIND in http.log, user agent Microsoft-WebDAV-MiniRedir) from clients to external IPs, time-correlated with a Visio launch.
      • Defender/AV telemetry: Escalate immediately on ASR block events (Event IDs 1121/1122 in Microsoft-Windows-Windows Defender/Operational) with Visio as the parent process.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

    Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    microsoftvisio
    • 2013
    • 2016
    • 2007
    • 2010
    • —
    • —
    • —
    • —
    microsoftvisio_viewer
    • 2010
    • 2007
    • —
    • —

    Vendors and products

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    Packet StormMicrosoft Visio DLL Hijacking (opens in a new tab)packetstormsecurity.comPoC (publicly reported)reported, not verified—

    References & sources

    • securify.nladvisory/SFY20150804/microsoft_visio_multiple_dll_side_loading_…x_refsource_MISC, Exploit, Third-party advisory
    • docs.microsoft.comMS16-070Vendor advisory, x_refsource_MS, Patch, Vendor advisory
    • securityfocus.com20160615 Microsoft Visio multiple DLL side loading vulnerabilitiesMailing list, x_refsource_BUGTRAQ, Broken link, Third-party advisory, Vulnerability database
    • securitytracker.com1036093Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
    • packetstormsecurity.comfiles/137490/Microsoft-Visio-DLL-Hijacking.htmlx_refsource_MISC, Third-party advisory, Vulnerability database
    • seclists.org20160615 Microsoft Visio multiple DLL side loading vulnerabilitiesMailing list, x_refsource_FULLDISC, Broken link, Mailing list, Third-party advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3235government-resource, US government resource
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2016-3235
    <a href="https://intel.neosec.eu/en/cve/CVE-2016-3235"><img src="https://intel.neosec.eu/badge/cve/CVE-2016-3235.svg?lang=en" alt="CVE-2016-3235 – NEOSEC Intel" height="20"></a>