CVE-2016-3351VulnerabilityPublished 05/24/2022Updated 10/24/2026

CVE-2016-3351: Microsoft Internet Explorer and Edge Information Disclosure Vulnerability

Affects Microsoft Internet Explorer and EdgeSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/24/2022
KEV deadline: 06/14/2022
Ransomware: Used in ransomware campaigns
EPSS: 26.5% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-3351 (opens in a new tab)

Description

CVE-2016-3351 is an information disclosure vulnerability in Microsoft Internet Explorer and Edge browsers. It arises from the way certain functions handle objects in memory, potentially allowing attackers to detect specific files on a user's computer. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

Summary

This vulnerability involves improper handling of objects in memory by certain functions in Internet Explorer and Edge, leading to information disclosure. Specifically, it could enable an attacker to detect the presence of specific files on the affected user's system. The vulnerability is tracked as CVE-2016-3351 and has been confirmed to be exploited in the wild, including use in ransomware campaigns.

Impact

Exploitation of this vulnerability can lead to unauthorized disclosure of information about files on a user's computer. This information disclosure can aid attackers in further targeting or tailoring attacks, including ransomware deployment. The vulnerability does not directly allow code execution but compromises user privacy and system confidentiality.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official remediation information is provided, users and administrators should monitor Microsoft advisories for updates and apply any available security updates promptly.

Weaknesses

CWE-200Information Exposure (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:42:21 UTC

Weaknesses

References

Related threats