CVE-2016-3303

Think of your computer’s ability to display fancy fonts like a “reader” that interprets font data inside documents and messages. This vulnerability is like a hole in that reader: a specially crafted font can trick the system into running attacker code. In practice, it’s the kind of problem that can turn a malicious file or message into a full device compromise.

This matters if you run or use Microsoft Windows (Vista SP2, Windows 7, Windows Server 2008 SP2/R2 SP1), Microsoft Office (2007 SP3/2010 SP2) and/or Word Viewer, and also Skype for Business/Lync/Live Meeting components. The risk is higher where your environment allows users to open untrusted documents or receive untrusted messages that get processed by these components—this is typically only a risk if the attacker can send you a crafted document/message that reaches the vulnerable component.

This is AMBER because there is known public exploit code and an attacker can use a crafted embedded font inside a document/message to try to run code. While it’s not confirmed as a CISA KEV item in the provided findings, the presence of a public exploit and rising attention means you should treat it as an active patch-now priority for any affected systems.

Confirm exposure

• Inventory your current environment for the affected software family and versions:
  • Windows Vista Service Pack 2, Windows 7, Windows Server 2008 Service Pack 2 and Windows Server 2008 R2 Service Pack 1.
  • Microsoft Office 2007 Service Pack 3 and Microsoft Office 2010 Service Pack 2.
  • Word Viewer.
  • Microsoft Lync / Skype for Business / Live Meeting components listed in the findings (Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, Live Meeting 2007 Console, and Skype for Business Server 2016).
• If any of these are present, confirm your patch level for the remediation described by Microsoft in MS16-097.

Patch/upgrade

• Follow Microsoft’s remediation guidance for MS16-097 (linked in the findings) for each affected product you use.
• Apply the relevant updates/configuration steps, then verify that the update installation completed successfully.

Temporary workaround (if patching is delayed)

• Use the MS16-097 guidance to limit exposure to crafted embedded fonts by tightening how untrusted content is handled (for example, restricting or filtering untrusted document/message sources and reducing workflows that invoke the vulnerable font rendering path).
• Keep in mind that the attacker needs a crafted file/message that triggers the embedded font processing, so reducing the likelihood that untrusted files/messages are opened is the goal.

What to monitor

• After changes, monitor for:
  • Office/Word Viewer/Skype for Business/Lync/Live Meeting-related crashes or abnormal behavior following content opens.
  • Security tooling alerts for suspicious process launches that occur immediately after opening documents or messages from external/untrusted sources.

Due date

• No CISA KEV due date was provided in the findings (KEV is not listed for this CVE).

CVE-2016-3303 is a weakness classified as CWE-20 (“Improper Input Validation”). The mechanism is remote code execution via a crafted embedded font processed by Windows Graphics Components used by Windows, Office, and the listed communication clients (Skype for Business/Lync/Live Meeting). The findings state that public exploit code is available (weaponization/exploit maturity is at least at the “public exploit exists” level), and press attention has been rising. KEV is not listed in the provided findings, so KEV-driven confirmation is not available here; therefore, exploitation status is best treated as “publicly weaponizable” rather than “officially confirmed in KEV.” The provided EPSS is a prediction and not used to drive public urgency because KEV/news confirmation is not present in the findings; also, the verdict for this CVE has been set to AMBER by the system.