{"history":[{"alert":0,"cve":"CVE-2016-7256","id":21668,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.64591, \"percentile\": 0.99252}"},{"alert":0,"cve":"CVE-2016-7256","id":19284,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.64591, \"percentile\": 0.99247}"},{"alert":0,"cve":"CVE-2016-7256","id":17250,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.64591, \"percentile\": 0.99246}"},{"alert":0,"cve":"CVE-2016-7256","id":15313,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.64591, \"percentile\": 0.99246}"},{"alert":0,"cve":"CVE-2016-7256","id":13291,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.64591, \"percentile\": 0.99246}"},{"alert":1,"cve":"CVE-2016-7256","id":12831,"kind":"cna","observed_at":1794025201,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-06T01:57:47.267Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://twitter.com/da5ch0/status/820161895269277696\"}, {\"name\": \"1037243\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"], \"url\": \"http://www.securitytracker.com/id/1037243\"}, {\"name\": \"MS16-132\", \"tags\": [\"vendor-advisory\", \"x_refsource_MS\", \"x_transferred\"], \"url\": \"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132\"}, {\"name\": \"94156\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/bid/94156\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2016-7256\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-02-10T16:40:44.326305Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2022-05-25\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7256\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-noinfo Not enough information\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:55:48.377Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7256\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-05-25T00:00:00.000Z\", \"value\": \"CVE-2016-7256 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"n/a\", \"vendor\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2016-11-08T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka \\\"Open Type Font Remote Code Execution Vulnerability.\\\"\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"n/a\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2018-10-12T19:57:01.000Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://twitter.com/da5ch0/status/820161895269277696\"}, {\"name\": \"1037243\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"], \"url\": \"http://www.securitytracker.com/id/1037243\"}, {\"name\": \"MS16-132\", \"tags\": [\"vendor-advisory\", \"x_refsource_MS\"], \"url\": \"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132\"}, {\"name\": \"94156\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"], \"url\": \"http://www.securityfocus.com/bid/94156\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"secure@microsoft.com\", \"ID\": \"CVE-2016-7256\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"n/a\", \"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}}]}, \"vendor_name\": \"n/a\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka \\\"Open Type Font Remote Code Execution Vulnerability.\\\"\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://twitter.com/da5ch0/status/820161895269277696\", \"refsource\": \"MISC\", \"url\": \"https://twitter.com/da5ch0/status/820161895269277696\"}, {\"name\": \"1037243\", \"refsource\": \"SECTRACK\", \"url\": \"http://www.securitytracker.com/id/1037243\"}, {\"name\": \"MS16-132\", \"refsource\": \"MS\", \"url\": \"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132\"}, {\"name\": \"94156\", \"refsource\": \"BID\", \"url\": \"http://www.securityfocus.com/bid/94156\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2016-7256\", \"datePublished\": \"2016-11-10T06:16:00.000Z\", \"dateReserved\": \"2016-09-09T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:55:48.377Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2016-7256","id":11073,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.64591, \"percentile\": 0.99245}"},{"alert":0,"cve":"CVE-2016-7256","id":8819,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.64591, \"percentile\": 0.99244}"},{"alert":0,"cve":"CVE-2016-7256","id":6607,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.64591, \"percentile\": 0.99243}"},{"alert":0,"cve":"CVE-2016-7256","id":4384,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.64591, \"percentile\": 0.99242}"},{"alert":0,"cve":"CVE-2016-7256","id":2166,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.64591, \"percentile\": 0.9924}"},{"alert":1,"cve":"CVE-2016-7256","id":1032,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2016-7256\", \"cwes\": [\"CWE-284\"], \"dateAdded\": \"2022-05-25\", \"dueDate\": \"2022-06-15\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2016-7256\", \"product\": \"Windows\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.\", \"vendorProject\": \"Microsoft\", \"vulnerabilityName\": \"Microsoft Windows Open Type Font Remote Code Execution Vulnerability\"}"}],"record":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T01:57:47.267Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://twitter.com/da5ch0/status/820161895269277696"},{"name":"1037243","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1037243"},{"name":"MS16-132","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132"},{"name":"94156","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/94156"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2016-7256","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-10T16:40:44.326305Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-05-25","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7256"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"description":"CWE-noinfo Not enough information","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:55:48.377Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7256"}],"timeline":[{"lang":"en","time":"2022-05-25T00:00:00.000Z","value":"CVE-2016-7256 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-11-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Open Type Font Remote Code Execution Vulnerability.\""}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-12T19:57:01.000Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"tags":["x_refsource_MISC"],"url":"https://twitter.com/da5ch0/status/820161895269277696"},{"name":"1037243","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1037243"},{"name":"MS16-132","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132"},{"name":"94156","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/94156"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2016-7256","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Open Type Font Remote Code Execution Vulnerability.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://twitter.com/da5ch0/status/820161895269277696","refsource":"MISC","url":"https://twitter.com/da5ch0/status/820161895269277696"},{"name":"1037243","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037243"},{"name":"MS16-132","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132"},{"name":"94156","refsource":"BID","url":"http://www.securityfocus.com/bid/94156"}]}}}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2016-7256","datePublished":"2016-11-10T06:16:00.000Z","dateReserved":"2016-09-09T00:00:00.000Z","dateUpdated":"2025-10-21T23:55:48.377Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794025201,"cve":"CVE-2016-7256","description":"atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Open Type Font Remote Code Execution Vulnerability.\"","epss":{"date":"2026-11-12","epss":0.64591,"percentile":0.99252},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2016-7256","cwes":["CWE-284"],"dateAdded":"2022-05-25","dueDate":"2022-06-15","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7256","product":"Windows","requiredAction":"Apply updates per vendor instructions.","shortDescription":"A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.","vendorProject":"Microsoft","vulnerabilityName":"Microsoft Windows Open Type Font Remote Code Execution Vulnerability"},"kev_checked":1794522003,"products":"n/a n/a","references":["https://twitter.com/da5ch0/status/820161895269277696","http://www.securitytracker.com/id/1037243","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132","http://www.securityfocus.com/bid/94156","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7256"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Microsoft Windows Open Type Font Remote Code Execution Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}