Product:
Visio
Summary
Microsoft Visio and its viewers mishandle library loading, allowing local users to gain privileges through a crafted application. This vulnerability is known as the Microsoft Office OLE DLL Side Loading Vulnerability. It affects multiple versions of Visio, including 2007, 2010, 2013, and 2016.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2016-3235 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious application that takes advantage of the improper library loading in Visio. The attacker can then convince a local user to open this crafted application, which would lead to privilege escalation on the affected system. User interaction is required for the exploit to be successful.
Affected Products
- Visio 2007 SP3: Affected by improper library loading.
- Visio 2010 SP2: Vulnerable to privilege escalation through crafted applications.
- Visio 2013 SP1: Susceptible to exploitation via DLL side loading.
- Visio 2016: Can be exploited through malicious applications.
- Visio Viewer 2007 SP3: Affected by the same vulnerability.
- Visio Viewer 2010: Vulnerable to privilege escalation.
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.