CVE-2016-0034 KEVRansomwareEnd of life High · 8.8 EPSS 69.4%

Microsoft Silverlight Runtime Remote Code Execution Vulnerability

Microsoft · Silverlight

End of lifeMicrosoft Silverlight reached on 12 Oct 2021. No patch is coming: remove or isolate it.

Summary

Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, a flaw in its runtime's input validation. A remote attacker can execute arbitrary code or cause a denial of service through object-header corruption by luring a user to a crafted web site, requiring no authentication but user interaction.

Official description · NVD

Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."

Breakdown

66.8 / 100

Exploited: Yes, in CISA KEV
Reports: 3
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules
What can follow
- Infect visitors through a malicious websiteT1189 · Drive-by CompromiseSource dataMedium confidence3 general detection rules
- Crash the applicationT1499.004 · Application or System ExploitationSource dataMedium confidence3 general detection rules

First seen exploited 49 days before it was disclosed.

First seen exploitedVulnCheck KEV evidence25 Nov 201549 days before
Disclosed13 Jan 2016day 0
Named in a threat reporttrendmicro.com27 Feb 2017+14 mo
Added to CISA KEVknown ransomware use; EU database agrees25 May 2022+6 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

3 , grouped by in kill-chain order, 3 cited passages 21

Initial AccessTA0001

Drive-by Compromise T1189 Medium

MITRE CTID mapping of the CVE · uncategorised

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Arbitrary code execution from decoding flaw

allows remote attackers to execute arbitrary code

From the official description (NVD) Original ↗

ImpactTA0040

Application or System Exploitation T1499.004 Medium

MITRE CTID mapping of the CVE · uncategorised

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploitation for Client ExecutionT1203 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 101 general rules for its techniques

Rules for this CVE

0 that reference CVE-2016-0034 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Drive-by CompromiseT11893 general rules

Cross Site Scripting Stringshightest
Flash Player Update from Suspicious Locationhightest
Suspicious Browser Child Process - MacOSmediumtest

Application or System ExploitationT1499.0043 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 3 threat reports

3 reportsTrend MicroMicrosoftforcepoint.comFeb 2017 · 2 undated

Reports are matched by finding the exact id CVE-2016-0034 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Trend Micro27 Feb 2017

RATANKBA: Delving into Large-scale Watering Holes

…detected as SWF_EXPLOYT.YYRQ) A Silverlight (.xap) file containing several files: an App Manifest (AppManifest.xaml), and DLLs Shell_siver.dll (TROJ_CVE20130074.B), and System.Xml.Linq.dll, which when repacked form a runtime remote code execution exploit for Silverlight (CVE-2016-0034, patched last January 12,…

Original (opens in a new tab) ↗

MicrosoftUndated

Microsoft Security

…day,” Securelist, January 13, 2016, https://securelist.com/blog/research/73255/the-mysterious-case-of-cve- 2016-0034-the-hunt-for-a-microsoft-silverlight-0-day/.

4 passages name itOriginal (opens in a new tab) ↗

forcepoint.comUndated

MONSOON – ANALYSIS OF AN APT CAMPAIGN

…could have been intended as an exploitation of something like CVE-2016-0034 which is known to have…

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

3 links, grouped by NVD tag (2 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 25 May 2022. Federal due date 15 Jun 2022. Known ransomware use.

The impacted products are end-of-life and should be disconnected if still in use.

ENISA

Marked exploited since 25 May 2022. EUVD-2016-0072

No public exploit code found.

, 30 Oct 2026

69.4%Top 0.64%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.36%).

3.1

8.8High · 8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 3993 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9936 19.9/20

Threat reports3 reports 7.7/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 8.8 6.2/7

End-of-life productNo patches exist; remove or isolate it −15.0

Total66.8

Record

Published: 13 Jan 2016
Modified: 14 Aug 2026
: CWE-20 Improper Input Validation
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1What they do

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques