CVE-2016-3298
Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability
Published Oct 13, 2016 · updated Jun 16, 2026 · microsoft internet explorer
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2016 · Catalog
Detected
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
May 24, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 14, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Required action
Apply updates per vendor instructions.
CISA due date Jun 14, 2022
Affected
- cpe microsoft/internet explorer10
- cpe microsoft/internet explorer11
- cpe microsoft/internet explorer9
- cpe microsoft/windows 7version unspecified
- cpe microsoft/windows server 2008version unspecified
- cpe microsoft/windows server 2008r2
- cpe microsoft/windows vistaversion unspecified
- vendor Microsoft Internet Explorerversion unspecified
Sources
- CISA KEVCVE-2016-3298
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
cisa.gov - CVE.orgCVE-2016-3298
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-3298
30-day exploitation probability 33.3%
first.org - NIST NVDCVE-2016-3298
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disc
nvd.nist.gov