CVE-2016-3298

6.5

MEDIUMCVSS v3.1 Base Score

33.33%

MEDIUM RiskEPSS (98th percentile)

KEV

NVD-CWE-noinfo

Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

Published: 10/14/2016

Modified: 6/17/2026

Back to CVE Lookup

ACTIVELY EXPLOITED IN THE WILD

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Vulnerability Name:

Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability

Vendor / Product:

Microsoft Internet Explorer

Required Action:

Apply updates per vendor instructions.

Due Date: 6/14/2022(OVERDUE)

Added to KEV:

5/24/2022

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2016-3298

View CISA KEV Catalog

Vulnerability Summary

CVSS v3 Score

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS v2 Score

2.6

AV:N/AC:H/Au:N/C:P/I:N/A:N

EPSS Score (Exploitation Probability)

33.33%MEDIUM Exploitation Risk

98th percentile

This vulnerability has a 33.33% probability of being exploited in the next 30 days, ranking higher than 98% of all scored CVEs.

CWE Classification

NVD-CWE-noinfo

Learn More

CVSS Calculator

View this score breakdown or calculate a custom score

Understanding CVSS Scoring

Learn how severity scores are calculated and what they mean

CVE Prioritization Guide

Best practices for deciding which vulnerabilities to address first

What is a CVE?

Essential guide to Common Vulnerabilities and Exposures