# CVE-2016-0149: TLS/SSL Information Disclosure Vulnerability

CVE-2016-0149 is fixed in 53 products on 1 platform, first by KB3156421, released May 10, 2016. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2016-0149
- Priority: High
- CVSS: n/a (Important)
- EPSS: 0.0839
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: yes
- Vendor exploitability assessment: Exploitation Unlikely
- Published: May 10, 2016
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2016-0149

## Description

<p>An information disclosure vulnerability exists in the TLS/SSL protocol, implemented in the encryption component of Microsoft .NET Framework. An attacker who successfully exploited this vulnerability could decrypt encrypted SSL/TLS traffic.</p> <p>To exploit the vulnerability, an attacker would first have to inject unencrypted data into the secure channel and then perform a <a href="https://technet.microsoft.com/en-us/library/security/dn848375.aspx#MiTM">man-in-the-middle (MiTM) attack</a> between the targeted client and a legitimate server. The update addresses the vulnerability by modifying the way that the .NET encryption component sends and receives encrypted network packets.</p> <p><strong>Important:</strong> Microsoft recommends that customers download and test the applicable update in controlled/managed environments before deploying it in their production environments.</p> <p>In case of application compatibility issues, the recommended approach is to ensure that the server and client endpoints are correctly implementing the TLS RFC, and that they can interpret two split records containing 1, n-1 bytes respectively after this update. For more information and developer guidance, see <a href="https://support.microsoft.com/kb/3155464">Microsoft Knowledge Base Article 3155464</a>.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2 |  | [KB3142023](https://patchblox.com/security/data/fix/microsoft/kb3142023.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2 |  | [KB3142023](https://patchblox.com/security/data/fix/microsoft/kb3142023.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2 |  | [KB3142023](https://patchblox.com/security/data/fix/microsoft/kb3142023.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 on Windows Vista Service Pack 2 |  | [KB3142023](https://patchblox.com/security/data/fix/microsoft/kb3142023.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 on Windows Vista x64 Edition Service Pack 2 |  | [KB3142023](https://patchblox.com/security/data/fix/microsoft/kb3142023.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for 32-bit Systems | 10586.318 | [KB3156421](https://patchblox.com/security/data/fix/microsoft/kb3156421.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for x64-based Systems | 10586.318 | [KB3156421](https://patchblox.com/security/data/fix/microsoft/kb3156421.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows 10 for 32-bit Systems | 10240.16854 | [KB3156387](https://patchblox.com/security/data/fix/microsoft/kb3156387.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows 10 for x64-based Systems | 10240.16854 | [KB3156387](https://patchblox.com/security/data/fix/microsoft/kb3156387.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows 8.1 for 32-bit systems |  | [KB3142026](https://patchblox.com/security/data/fix/microsoft/kb3142026.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows 8.1 for x64-based systems |  | [KB3142026](https://patchblox.com/security/data/fix/microsoft/kb3142026.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows Server 2012 |  | [KB3142025](https://patchblox.com/security/data/fix/microsoft/kb3142025.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows Server 2012 (Server Core installation) |  | [KB3142025](https://patchblox.com/security/data/fix/microsoft/kb3142025.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows Server 2012 R2 |  | [KB3142026](https://patchblox.com/security/data/fix/microsoft/kb3142026.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5 on Windows Server 2012 R2 (Server Core installation) |  | [KB3142026](https://patchblox.com/security/data/fix/microsoft/kb3142026.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5.1 on Windows 7 for 32-bit Systems |  | [KB3142024](https://patchblox.com/security/data/fix/microsoft/kb3142024.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5.1 on Windows 7 for x64-based Systems Service Pack 1 |  | [KB3142024](https://patchblox.com/security/data/fix/microsoft/kb3142024.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 |  | [KB3142024](https://patchblox.com/security/data/fix/microsoft/kb3142024.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 |  | [KB3142024](https://patchblox.com/security/data/fix/microsoft/kb3142024.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |  | [KB3142024](https://patchblox.com/security/data/fix/microsoft/kb3142024.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows 7 for 32-bit Systems Service Pack 1 |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows 7 for x64-based Systems Service Pack 1 |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows 8.1 for 32-bit systems |  | [KB3142030](https://patchblox.com/security/data/fix/microsoft/kb3142030.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows 8.1 for x64-based systems |  | [KB3142030](https://patchblox.com/security/data/fix/microsoft/kb3142030.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows RT 8.1 |  | [KB3142030](https://patchblox.com/security/data/fix/microsoft/kb3142030.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2 |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2 |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2012 |  | [KB3142032](https://patchblox.com/security/data/fix/microsoft/kb3142032.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2012 (Server Core installation) |  | [KB3142032](https://patchblox.com/security/data/fix/microsoft/kb3142032.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 |  | [KB3142030](https://patchblox.com/security/data/fix/microsoft/kb3142030.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 (Server Core installation) |  | [KB3142030](https://patchblox.com/security/data/fix/microsoft/kb3142030.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Vista Service Pack 2 |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.5.2 on Windows Vista x64 Edition Service Pack 2 |  | [KB3142033](https://patchblox.com/security/data/fix/microsoft/kb3142033.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6 on Windows 10 for 32-bit Systems | 10240.16854 | [KB3156387](https://patchblox.com/security/data/fix/microsoft/kb3156387.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6 on Windows 10 for x64-based Systems | 10240.16854 | [KB3156387](https://patchblox.com/security/data/fix/microsoft/kb3156387.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6 on Windows Server 2008 for 32-bit Systems Service Pack 2 |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6 on Windows Server 2008 for x64-based Systems Service Pack 2 |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6 on Windows Vista Service Pack 2 |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6 on Windows Vista x64 Edition Service Pack 2 |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for 32-bit Systems | 10586.318 | [KB3156421](https://patchblox.com/security/data/fix/microsoft/kb3156421.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for x64-based Systems | 10586.318 | [KB3156421](https://patchblox.com/security/data/fix/microsoft/kb3156421.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows 7 for 32-bit Systems Service Pack 1 |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows 7 for x64-based Systems Service Pack 1 |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows 8.1 for 32-bit systems |  | [KB3142036](https://patchblox.com/security/data/fix/microsoft/kb3142036.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows RT 8.1 |  | [KB3142036](https://patchblox.com/security/data/fix/microsoft/kb3142036.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |  | [KB3142037](https://patchblox.com/security/data/fix/microsoft/kb3142037.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 |  | [KB3142035](https://patchblox.com/security/data/fix/microsoft/kb3142035.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 (Server Core installation) |  | [KB3142035](https://patchblox.com/security/data/fix/microsoft/kb3142035.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 R2 |  | [KB3142036](https://patchblox.com/security/data/fix/microsoft/kb3142036.md) | May 10, 2016 |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 R2 (Server Core installation) |  | [KB3142036](https://patchblox.com/security/data/fix/microsoft/kb3142036.md) | May 10, 2016 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.