{"id":"CVE-2016-3351","kind":"vulnerability","aliases":["CVE-2016-3351"],"related":[],"title":"Microsoft Internet Explorer and Edge: Microsoft Internet Explorer and Edge Information Disclosure Vulnerability","description":"An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A memory-handling flaw in certain Internet Explorer and Edge functions lets a web page detect whether specific files exist on the visitor's computer. Attackers get file-presence information, not file contents, and CISA lists it as actively exploited.","severity":"medium","cvss":6.5,"epss":0.26483,"exploited":true,"exploited_at":"2022-05-24T00:00:00+00:00","products":[{"name":"Microsoft Internet Explorer and Edge","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["edge-legacy","exploited","internet-explorer","other","ransomware","windows"],"not_affected_if":["chromium-edge-only","patched-systems"],"how_to_check":"Check whether Internet Explorer or Edge (legacy) is installed and on a version older than the Microsoft 2016 security update: run winver or check Apps and Features.","fix":"Apply the Microsoft security update for Internet Explorer and Edge released for MS16-037 (per CISA's required action: apply updates per vendor instructions).\nMove users off Internet Explorer and Edge Legacy to a current browser.","status":"open","published_at":"2016-09-14T10:59:24+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:50+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T21:15:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for Internet Explorer and Edge released for MS16-037 (per CISA's required action: apply updates per vendor instructions).\nMove users off Internet Explorer and Edge Legacy to a current browser.","reach":"internet","impact":"low","summary":"A memory-handling flaw in certain Internet Explorer and Edge functions lets a web page detect whether specific files exist on the visitor's computer. Attackers get file-presence information, not file contents, and CISA lists it as actively exploited.","category":"other","who_cares":["windows","internet-explorer","edge-legacy"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker learns whether chosen files exist on the visitor's machine","analyst_note":"Confirm the exact patched build numbers and the MS16-037 bulletin at https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-037 since the sources give no version data.","how_to_check":"Check whether Internet Explorer or Edge (legacy) is installed and on a version older than the Microsoft 2016 security update: run winver or check Apps and Features.\nunknown","needs_analyst":true,"not_affected_if":["chromium-edge-only","patched-systems"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000526,"input_tokens":2873,"output_tokens":478,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':15A,18A '-3351':16A,19A 'action':114C 'activ':75B 'allow':100C 'and':23A 'appli':115C 'attack':61B,102C 'certain':41B,86C 'cisa':71B,112C 'comput':60B,111C 'content':69B 'could':99C 'cve':14A,17A 'detect':51B,104C 'disclosur':12A,79C 'edg':5A,10A,26B,45B,92C 'edge':24A 'edge-legaci':25B 'exist':55B,81C 'exploit':28B,76B 'explor':3A,8A,31B,43B,90C 'explorer':22A 'file':54B,64B,68B,106C 'file-pres':63B 'flaw':39B 'function':46B,87C 'get':62B 'handl':38B,93C 'inform':11A,66B,78C 'instruct':119C 'internet':2A,7A,21A,30B,42B,89C 'internet-explor':29B 'legaci':27B 'let':47B 'list':72B 'memori':37B,96C 'memory-handl':36B 'microsoft':1A,6A,20A 'object':94C 'page':50B 'per':117C 'presenc':65B 'ransomwar':33B 'requir':113C 'specif':53B,105C 'updat':116C 'user':109C 'vendor':118C 'visitor':58B 'vulner':13A,80C,98C 'way':84C 'web':49B 'whether':52B 'window':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-09-14T10:59:24+00:00","kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-3351","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3351","severity":null,"published_at":"2022-05-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2016-3351","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3351","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-3351","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3351","severity":null,"published_at":"2016-09-14T10:59:24+00:00","modified_at":"2026-08-14T05:16:53+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}