CVE-2016-3358

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel...

7.8 High

CVE-2016-3358 is a high vulnerability (CVSS 7.8) in Microsoft Excel, published September 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 18.4%, the 97th percentile. No source names a fixed version.

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, Excel Automation Services on SharePoint Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

18.4%Down 29.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.8

Record: CVE-2016-3358
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-3358
Updated: 2026-11-02

EUVDEUVD-2016-4389 No score

Record: EUVD-2016-4389
Updated: 2026-11-03

GitHub AdvisoriesGHSA-87pf-j2gx-jjvx 7.8

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel...

Record: GHSA-87pf-j2gx-jjvx
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD