CVE-2016-7256VulnerabilityPublished 05/25/2022Updated 10/24/2026

CVE-2016-7256: Microsoft Windows Open Type Font Remote Code Execution Vulnerability

Affects Microsoft WindowsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/25/2022
KEV deadline: 06/15/2022
EPSS: 64.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-7256 (opens in a new tab)

Description

CVE-2016-7256 is a remote code execution vulnerability in the Microsoft Windows font library caused by improper handling of specially crafted embedded fonts. Successful exploitation allows an attacker to take control of the affected system. This vulnerability has been exploited in the wild.

Summary

This vulnerability arises from the Windows font library's improper processing of specially crafted embedded fonts, enabling remote code execution. An attacker exploiting this flaw can gain control over the affected Windows system. The vulnerability is tracked as CVE-2016-7256 and has been observed in active exploitation scenarios.

Impact

Exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected Windows systems, potentially leading to full system compromise. It has been confirmed to be exploited in the wild, indicating active threat usage.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.

Weaknesses

CWE-284Improper Access Control (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:50:50 UTC

Weaknesses

References

Related threats