# CVE-2016-0194: Internet Explorer Information Disclosure Vulnerability

CVE-2016-0194 is fixed in 9 products on 1 platform, first by KB3156421, released May 10, 2016. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2016-0194
- Priority: Routine
- CVSS: n/a (Low)
- EPSS: 0.1551
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Vendor exploitability assessment: Exploitation Less Likely
- Published: May 10, 2016
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2016-0194

## Description

<p>An information disclosure vulnerability exists when Internet Explorer does not properly handle file access permissions, which could allow an attacker to disclose the contents of arbitrary files on the user's computer. An attacker who successfully exploited the vulnerability could potentially read data that was not intended to be disclosed. Note that the vulnerability would not allow an attacker to execute code or to elevate a user’s rights directly, but the vulnerability could be used to obtain information in an attempt to further compromise the affected system.</p> <p>In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince users to take action. For example, an attacker could trick users into clicking a link that takes them to the attacker's site.</p> <p>The update addresses the vulnerability by helping to ensure that file access permissions are properly validated before returning file data to the user.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Microsoft | Internet Explorer 10 on Windows Server 2012 |  | [KB3154070](https://patchblox.com/security/data/fix/microsoft/kb3154070.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows 10 Version 1511 for 32-bit Systems | 10586.318 | [KB3156421](https://patchblox.com/security/data/fix/microsoft/kb3156421.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows 10 Version 1511 for x64-based Systems | 10586.318 | [KB3156421](https://patchblox.com/security/data/fix/microsoft/kb3156421.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows 10 for 32-bit Systems | 10240.16854 | [KB3156387](https://patchblox.com/security/data/fix/microsoft/kb3156387.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows 10 for x64-based Systems | 10240.16854 | [KB3156387](https://patchblox.com/security/data/fix/microsoft/kb3156387.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows 8.1 for 32-bit systems |  | [KB3154070](https://patchblox.com/security/data/fix/microsoft/kb3154070.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows 8.1 for x64-based systems |  | [KB3154070](https://patchblox.com/security/data/fix/microsoft/kb3154070.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows RT 8.1 |  | [KB3154070](https://patchblox.com/security/data/fix/microsoft/kb3154070.md) | May 10, 2016 |
| Microsoft | Internet Explorer 11 on Windows Server 2012 R2 |  | [KB3154070](https://patchblox.com/security/data/fix/microsoft/kb3154070.md) | May 10, 2016 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo