# CVE-2016-3235

Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

- Page: https://www.vulneraibility.com/cve/CVE-2016-3235
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2022-05-03
- EPSS: 43.31% (percentile 98.7)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module (first 2015-12-08)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-10)
- Published: 2016-06-16

## Affected

- microsoft:visio
- microsoft:visio_viewer

## References

- [other] https://www.securify.nl/advisory/SFY20150804/microsoft_visio_multiple_dll_side_loading_vulnerabilities.html
- [advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-070
- [other] http://www.securityfocus.com/archive/1/538685/100/0/threaded
- [other] http://www.securitytracker.com/id/1036093
- [other] http://packetstormsecurity.com/files/137490/Microsoft-Visio-DLL-Hijacking.html
- [other] http://seclists.org/fulldisclosure/2016/Jun/32
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3235

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.