CVE-2016-7227

Vulnerability

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge contain an information disclosure vulnerability, tracked as CVE-2016-7227, that allows remote attackers to determine the existence of local files on a victim's system. The issue is present in Internet Explorer 9, 10, and 11 on supported Windows clients and servers, as well as Microsoft Edge on Windows 10 and Windows Server 2016. Microsoft has not publicly detailed the precise code path or required conditions, but the vulnerability is addressed in cumulative security updates MS16-142 (for Internet Explorer) and MS16-129 (for Microsoft Edge) [1][2].

Exploitation

An attacker can exploit this vulnerability by hosting a specially crafted webpage that invokes the scripting engine's unspecified functionality. The victim must visit the malicious page using an affected browser (Internet Explorer 9, 10, or 11, or Microsoft Edge). No additional authentication or user interaction beyond browsing to the site is required [1][2]. The exact exploitation steps are not publicly documented, but the attack vector is network-based (remote) and does not require any special privileges.

Impact

Successful exploitation allows the attacker to determine whether specific local files exist on the victim's machine. This is a low-severity information disclosure (CVSS v3 base score 3.1) that impacts confidentiality by revealing file-system state (existence of files) without necessarily exposing file contents. The disclosure does not enable code execution, privilege escalation, or data modification on its own [1][2].

Mitigation

Microsoft released security updates to address this vulnerability in November 2016: Internet Explorer users should apply MS16-142 (KB 3198467, which includes the fix), and Microsoft Edge users should apply MS16-129 (KB 3199057) [1][2]. These updates were included in the November 2016 Patch Tuesday. No workarounds have been published by Microsoft, and the affected browsers must be updated to the latest cumulative security patches. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.