CVE-2016-0199

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0200 and CVE-2016-3211.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/137533/Microsoft-Internet-Explorer-11-Garbage-Collector-Attribute-Type-Confusion.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/Jun/44Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/538706/100/0/threaded
http://www.securitytracker.com/id/1036096Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
https://www.exploit-db.com/exploits/39994/Exploit, Third Party Advisory, VDB Entry
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1226Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/137533/Microsoft-Internet-Explorer-11-Garbage-Collector-Attribute-Type-Confusion.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/Jun/44Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/538706/100/0/threaded
http://www.securitytracker.com/id/1036096Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
https://www.exploit-db.com/exploits/39994/Exploit, Third Party Advisory, VDB Entry
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1226Third Party Advisory, VDB Entry

Timeline

Published: Jun 16, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-02008.8Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) CVE-2016-02015.9GSKit in IBM Security Network Protection 5.3.1 before 5.3.1.7 and 5.3.2 allows remote attackers to discover credentials by triggering an MD5 CVE-2016-02023.3A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orc CVE-2016-02035.5A vulnerability has been identified in the IBM Cloud Orchestrator task API. The task API might allow an authenticated user to view backgroun CVE-2016-02046.8Open redirect vulnerability in IBM Cloud Orchestrator 2.4.x before 2.4.0 FP3 allows remote authenticated users to redirect users to arbitrar CVE-2016-02053.3A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authenticati CVE-2016-02063.3IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a spe CVE-2016-02075.4IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via u CVE-2016-02083.7IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of servic CVE-2016-02096.1Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF09 allows remote attackers to inject arbitrary web script or CVE-2016-02105.3IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method,CVE-2016-02114.3IBM DB2 9.7 through FP11, 9.8, 10.1 through FP5, and 10.5 through FP7 on Linux, UNIX, and Windows allows remote authenticated users to cause