---
id: "CVE-2016-0162"
kind: "vulnerability"
aliases: ["CVE-2016-0162"]
title: "Microsoft Internet Explorer: Microsoft Internet Explorer Information Disclosure Vulnerability"
severity: "medium"
cvss: 4.3
epss: 0.22012
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Internet Explorer", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "internet-explorer", "windows"]
not_affected_if: ["unknown"]
published_at: "2016-04-12T23:59:26+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0162", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-0162", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0162", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Internet Explorer: Microsoft Internet Explorer Information Disclosure Vulnerability

Internet Explorer mishandles JavaScript, letting a web page detect whether specific files exist on the visitor's computer. An attacker gets information about local files, not code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Internet Explorer affected ? fixed ?

## Fix

Apply the Microsoft security update for CVE-2016-0162 per vendor instructions; the sources do not name the patched build.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0162
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-0162
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-0162

## From the sources

An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_