CVE-2016-3304

This flaw is in Windows’ handling of fonts. Attackers can hide malicious content inside something you might open (like a document or other embedded content), and when the system processes that font it can end up running attacker code. Think of it like a “looking-glass” file format: the file looks normal, but the font payload is the part that does the damage.

This matters if your business uses affected Microsoft Windows versions (like Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1) and/or affected Office and communication apps (Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Live Meeting).

Because the weakness requires user interaction (opening/processing crafted content), it’s mainly a risk if an attacker can send you a crafted file or content that your staff opens on an unpatched machine.

This is AMBER because there is a public exploit available and the problem lets attackers run code on unpatched machines through crafted embedded fonts. Even without a confirmed “actively exploited in the wild” listing, the availability of weaponized tooling means you should prioritize patching now rather than later.

1. Inventory and determine exposure

• Confirm whether any systems run: Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2 and R2 Service Pack 1, or Windows 7 Service Pack 1.
• Confirm whether any systems run affected software: Office 2007 Service Pack 3, Office 2010 Service Pack 2, Word Viewer, Skype for Business 2016, Lync 2013 Service Pack 1, and Live Meeting.

2. Check whether the fix is installed

• On each identified machine, check patch status against the remediation referenced by Microsoft guidance MS16-097.
• If you use a managed patching tool (WSUS/SCCM/endpoint management), check whether the MS16-097 updates are present and fully applied.

3. Upgrade/patch (target)

• Apply the remediation described in Microsoft’s MS16-097 guidance to bring vulnerable components up to the fixed state.

4. Temporary containment if you can’t patch immediately

• Reduce the chance staff open malicious attachments: restrict email/document opening from unknown or unexpected sources.
• For high-risk users or shared PCs, tighten controls around viewing external documents and other embedded-content handling until patches are deployed.

5. What to monitor after patching

• Monitor endpoint alerts/logs for suspicious Office/Windows font-processing behavior and unexpected process launches tied to opened documents.
• Confirm no recurring failures in patch deployment (e.g., machines that repeatedly miss MS16-097 due to reboot requirements).

6. Timing note

• No CISA KEV listing is provided for this CVE in the findings, so the “deadline” is not specified here; treat it as urgent operational hygiene because public exploitation exists.

CVE-2016-3304 is categorized under CWE-20 (improper input validation). The attack mechanism involves a crafted embedded font that causes Windows’ font handling to execute attacker-controlled code—classed as “Windows Graphics Component RCE Vulnerability” in the description, distinct from CVE-2016-3303. The findings indicate a public exploit is available (1 known) and that Microsoft remediation guidance exists under MS16-097. KEV is not listed. Exploitation is not confirmed by the provided findings, but the presence of weaponized public exploit tooling makes unpatched exposure high-risk. EPSS is a prediction (50.5%) and remains flat; however, because no KEV/news confirmation is provided here, that prediction should be treated as indicative rather than decisive. Reaching exploitation requires user interaction (the crafted content must be processed/opened), consistent with the vulnerability’s modeled requirements.