CVE-2016-0034highunder attackransomware

CVE-2016-0034

Published · Updated

Follow this CVE+ Monitor Silverlight

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 69%
from disclosure to weapon
Published on NVDJan 13
CISA KEV+2324d
Action required by CISAfederal deadline: 2022-06-15

The impacted products are end-of-life and should be disconnected if still in use.

In short

Microsoft Silverlight 5 has a flaw in how it processes certain data from websites, allowing attackers to run malicious code or crash the application through a specially crafted web page.

Technical detail

Silverlight 5 mishandles negative offsets during decoding operations, enabling remote code execution or denial of service via object-header corruption. Attack vector is network-based through a malicious web site; no user interaction beyond visiting the site is required. Impact includes arbitrary code execution in the Silverlight runtime context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a