---
id: "CVE-2016-3351"
kind: "vulnerability"
aliases: ["CVE-2016-3351"]
title: "Microsoft Internet Explorer and Edge: Microsoft Internet Explorer and Edge Information Disclosure Vulnerability"
severity: "medium"
cvss: 6.5
epss: 0.26483
exploited: true
status: "open"
category: "other"
products: [{"name": "Microsoft Internet Explorer and Edge", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["edge-legacy", "exploited", "internet-explorer", "other", "ransomware", "windows"]
not_affected_if: ["chromium-edge-only", "patched-systems"]
published_at: "2016-09-14T10:59:24+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3351", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-3351", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3351", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Internet Explorer and Edge: Microsoft Internet Explorer and Edge Information Disclosure Vulnerability

A memory-handling flaw in certain Internet Explorer and Edge functions lets a web page detect whether specific files exist on the visitor's computer. Attackers get file-presence information, not file contents, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Internet Explorer and Edge affected ? fixed ?

## How to check

Check whether Internet Explorer or Edge (legacy) is installed and on a version older than the Microsoft 2016 security update: run winver or check Apps and Features.

## Fix

Apply the Microsoft security update for Internet Explorer and Edge released for MS16-037 (per CISA's required action: apply updates per vendor instructions).
Move users off Internet Explorer and Edge Legacy to a current browser.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3351
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-3351
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-3351

## From the sources

An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_