{
  "cveId": "CVE-2016-3244",
  "url": "https://patchblox.com/security/cve/CVE-2016-3244",
  "summary": "CVE-2016-3244 is fixed in 4 products on 1 platform, first by KB3172985, released July 12, 2016. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Microsoft Edge Security Feature Bypass Vulnerability",
  "description": "\u003Cp\u003EA security feature bypass vulnerability exists when Microsoft Edge does not properly implement \u003Ca href=\u0022https://technet.microsoft.com/library/security/dn848375.aspx#ASLR\u0022\u003EAddress Space Layout Randomization (ASLR)\u003C/a\u003E. The vulnerability could allow an attacker to bypass the ASLR security feature, after which the attacker could load additional malicious code in the process in an attempt to exploit another vulnerability.\u003C/p\u003E\n\u003Cp\u003EAn attacker who successfully exploited this vulnerability could bypass the ASLR security feature, which protects users from a broad class of vulnerabilities. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability that could take advantage of the ASLR bypass to run arbitrary code.\u003C/p\u003E\n\u003Cp\u003EIn a web-based attack scenario, an attacker could host a website used to attempt to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted website. Instead, an attacker would have to convince users to take action. For example, an attacker could trick users into clicking a link that takes them to the attacker\u0027s site.\u003C/p\u003E\n\u003Cp\u003EThe update addresses the vulnerability by helping to ensure that Microsoft Edge properly implements ASLR.\u003C/p\u003E",
  "published": "2016-07-12T07:00:00Z",
  "severity": "Important",
  "cvss": 4.3,
  "epss": 0.18752,
  "epssPercentile": 0.97288,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation Less Likely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2016-3244",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for 32-bit Systems",
      "fixedVersion": "10586.494",
      "fix": "KB3172985",
      "url": "https://patchblox.com/security/fix/microsoft/kb3172985",
      "released": "2016-07-12T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for x64-based Systems",
      "fixedVersion": "10586.494",
      "fix": "KB3172985",
      "url": "https://patchblox.com/security/fix/microsoft/kb3172985",
      "released": "2016-07-12T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems",
      "fixedVersion": "10240.17024",
      "fix": "KB3163912",
      "url": "https://patchblox.com/security/fix/microsoft/kb3163912",
      "released": "2016-07-12T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems",
      "fixedVersion": "10240.17024",
      "fix": "KB3163912",
      "url": "https://patchblox.com/security/fix/microsoft/kb3163912",
      "released": "2016-07-12T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}