Microsoft · Silverlight
CVE-2016-0034
Microsoft Silverlight Runtime Remote Code Execution Vulnerability
What it is
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
CISA: Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).
What to do
The impacted products are end-of-life and should be disconnected if still in use.
Deadline for US federal agencies: June 15, 2022
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | Double Dereference | Silverlight | High 7.8 | 79% |
| May 25, 2022 | Information Disclosure | Silverlight | Medium 5.5 | 68% |
| Oct 13, 2026 | Command Injection | Windows | High 8.8 | 9.8% |
| Sep 25, 2026 | Code Injection | SharePoint | High 8.8 | 8.2% |
| Sep 8, 2026 | Link Following | Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Windows | High 7.8 | 0.4% |
| Aug 26, 2026 | Remote Code Execution | SQL Server | High 8.8 | 57% |
| Aug 18, 2026 | Double Free | Internet Key Exchange (IKE) Service Extensions | Critical 9.8 | 77% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.