Actively exploited · Published Jan 13, 2016 · Assigned by microsoft
CVE-2016-0034
High 8.8 Exploited Ransomware
In plain English
A high-severity security flaw in Silverlight from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 69.4% (higher than 99.4% of all known vulnerabilities). The impacted products are end-of-life and should be disconnected if still in use.
CISA guidance
The impacted products are end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Jun 15, 2022.
Official description
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
Affected products (as reported)
References
- 1034655 vdb-entry, x_refsource_SECTRACK
- MS16-006 vendor-advisory, x_refsource_MS
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0034 government-resource