CVE DatabaseCVE-2016-0034

Updated 2026-08-14한국어 권고문 →

CVE-2016-00348.8/HIGHCISA KEV

Microsoft Silverlight Negative Offset Decoding Remote Code Execution Vulnerability (CVE-2016-0034, MS16-006)

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

silverlight

Published Date

2016-01-13

CVSS v3.1

8.8

HIGH

EPSS (30d)

69.4%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Microsoft Silverlight 5 versions prior to 5.1.41212.0

Impact

Remote attackers can execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web application

Mitigation

Upgrade Microsoft Silverlight to version 5.1.41212.0 or later, or completely disable/uninstall the Silverlight plugin from the system

Affected Products & Version Scope

Microsoft Silverlight 5 (all versions prior to 5.1.41212.0)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official Microsoft security update (MS16-006) to upgrade Silverlight to version 5.1.41212.0 or later. You can verify the installed version and identify vulnerable assets using the following PowerShell script:

powershell

# PowerShell script to detect installed Silverlight version
$silverlightPath = '${env:ProgramFiles}\Microsoft Silverlight\sliverlight.configuration.exe'
if (Test-Path $silverlightPath) {
    $version = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($silverlightPath).FileVersion
    Write-Host 'Current Silverlight Version:' $version
    if ([Version]$version -lt [Version]'5.1.41212.0') {
        Write-Warning 'Vulnerable version detected. Immediate update or removal required.'
    } else {
        Write-Host 'Secure version is installed.' -ForegroundColor Green
    }
} else {
    Write-Host 'Silverlight is not installed on this system.'
}

2. Temporary Workaround & Hardening Configuration

Since Silverlight has reached End-of-Life (EOL), the recommended workaround is to disable the Silverlight ActiveX control in Internet Explorer via the registry (Kill Bit) to prevent web-based exploitation.

cmd

:: Set ActiveX Kill Bit for Silverlight to prevent execution in Internet Explorer
reg add 'HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DFEAF541-F3E1-4c24-ACAC-99C30715084A}' /v 'Compatibility Flags' /t REG_DWORD /d 0x00000400 /f
reg add 'HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DFEAF541-F3E1-4c24-ACAC-99C30715084A}' /v 'Compatibility Flags' /t REG_DWORD /d 0x00000400 /f

3. Log Audit & IoC Verification Commands

Monitor system event logs for abnormal child processes spawned by web browsers, which may indicate successful exploitation and shellcode execution.

powershell

# Query Security Event Log (Event ID 4688) for suspicious child processes spawned by Internet Explorer
Get-WinEvent -FilterHashtable @{
    LogName='Security';
    Id=4688
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Properties.Value -match 'iexplore.exe' -and 
    ($_.Properties.Value -match 'cmd.exe' -or $_.Properties.Value -match 'powershell.exe')
} | Select-Object TimeCreated, @{N='ParentProcess';E={$_.Properties.Value}}, @{N='NewProcess';E={$_.Properties.Value}} | Format-Table -AutoSize

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Because Silverlight is End-of-Life (EOL), it is highly recommended to completely uninstall the Silverlight runtime from all enterprise endpoints to eliminate the attack surface.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2016-0034) exists in the Microsoft Silverlight 5 runtime engine during the decoding of media or data streams. The root cause lies in the decoder's failure to properly validate offset values before processing input data, allowing negative offsets to be processed during decoding operations. This logical flaw leads to an out-of-bounds write/read condition, resulting in object-header corruption within the application memory space.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by hosting a specially crafted Silverlight application (typically packaged as a .XAP file) on a malicious or compromised website. When a user with a vulnerable Silverlight plugin visits the site (Drive-by Download), the browser loads and executes the malicious Silverlight application. As the decoder processes the negative offset, it triggers memory corruption, allowing the attacker to bypass memory protections, hijack the execution flow, and execute arbitrary code under the security context of the logged-in user.

3. Infrastructure & Business Impact

As a vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2016-0034 poses a severe threat with confirmed active exploitation history. Successful exploitation grants the attacker initial access to the endpoint, which can lead to lateral movement, sensitive data exfiltration, or ransomware deployment. For enterprises maintaining legacy Silverlight environments for internal applications, this represents a critical risk of complete endpoint compromise.

Official Vendor Advisories & References

NVD Original English Description

Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."

http://www.securitytracker.com/id/1034655

Source: secure@microsoft.com · Broken Link, Third Party Advisory, VDB Entry

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-006

Source: secure@microsoft.com · Patch, Vendor Advisory

http://www.securitytracker.com/id/1034655

Source: af854a3a-2127-422b-91ae-364da2661108 · Broken Link, Third Party Advisory, VDB Entry

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-006

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0034

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2016-0034)

FAQ

Q1. How critical is CVE-2016-0034 and is it actively exploited in the wild?

CVE-2016-0034 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 69.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2016-0034?

Primary impacted vendors include microsoft across silverlight. Scope summary: Microsoft Silverlight 5 (all versions prior to 5.1.41212.0)

Q3. What temporary mitigations or workarounds exist for CVE-2016-0034 before patching?

[Mitigation] Upgrade Microsoft Silverlight to version 5.1.41212.0 or later, or completely disable/uninstall the Silverlight plugin from the system Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION