CVE-2016-7204

Vulnerability

Microsoft Edge contains an information disclosure vulnerability that allows a remote attacker to access arbitrary files from the user's "My Documents" folder. The issue exists in how Edge handles requests from a specially crafted website. Affected versions include Microsoft Edge on Windows 10 for 32-bit and x64-based systems, Windows 10 Version 1511, and Windows Server 2016, as listed in Microsoft Security Bulletin MS16-129 [1].

Exploitation

An attacker must host a malicious website and convince a user to visit it using Microsoft Edge. No additional authentication or privileges are required beyond the user's normal browsing session. The attacker can then read files from the user's "My Documents" folder without further interaction [1].

Impact

Successful exploitation results in information disclosure, allowing the attacker to read arbitrary files from the victim's "My Documents" folder. This could expose sensitive documents, such as personal or business files, but does not grant code execution or elevated privileges [1].

Mitigation

Microsoft released security update MS16-129 (KB 3199057) on November 8, 2016, which addresses this vulnerability. Users should apply the update via Windows Update or other deployment methods. No workarounds are documented [1].