Microsoft Visio OLE DLL Side Loading Local Privilege Escalation Vulnerability (CVE-2016-3235, MS16-070)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2016-3235) exists in Microsoft Visio and Visio Viewer due to an insecure library loading mechanism when handling Object Linking and Embedding (OLE) objects. The application fails to validate the absolute path of required dynamic link libraries (DLLs) and prioritizes the Current Working Directory (CWD) during the resolution process. This design flaw allows an attacker to perform a 'DLL Side-Loading' or 'DLL Hijacking' attack by placing a crafted DLL in the directory from which the application is launched.

2. Exploitation Mechanics & Attack Scenario

An attacker crafts a malicious DLL and names it after a legitimate library that Visio attempts to load (e.g., mfc42u.dll). The attacker then packages this malicious DLL in the same directory as a legitimate Visio document (.vsd or .vsdx) and distributes it via social engineering (e.g., compressed archives, network shares, or USB drives). When the victim opens the Visio file, the application searches the current directory first, loading and executing the malicious DLL under the security context of the logged-in user, bypassing standard security controls.

3. Infrastructure & Business Impact

As a vulnerability listed in the CISA KEV catalog, CVE-2016-3235 has been actively exploited in the wild. Successful exploitation allows attackers to establish an initial foothold on the endpoint. In corporate environments where Visio diagrams are frequently shared among engineering, architecture, and IT teams, this vulnerability poses a severe threat, potentially leading to lateral movement, credential theft, and full domain compromise.