Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2016-0012

CVE-2016-0012MEDIUM

n/a n/a — Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoin…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  L  N  N    4.3   .1092   95.8     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Dec 4   Reserved by microsoft
  Jan 13  Published (CNA: microsoft)
  Oct 15  ENRICHED — CVE-2016-0012. Received CVSS 4.3 and CPE data from NVD.

CWE-200 · CNA: microsoft · CVSS v3.0 · 2 references · NVD status: Modified

Description

Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office 2016, Excel 2016, PowerPoint 2016, Visio 2016, Word 2016, and Visual Basic 6.0 Runtime allow remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Microsoft Office ASLR Bypass."

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 4, 2015	Reserved	Reserved by microsoft
January 13, 2016	Published	Published (CNA: microsoft)
October 15, 2026	ENRICHED	ENRICHED — CVE-2016-0012. Received CVSS 4.3 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	n/a	—	n/a	—

Weaknesses

CWE-200

References (2)

Authoritative record: CVE-2016-0012 at cve.org

Weaknesses: CWE-200

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2016-0012 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.