# CVE-2016-0012: CVE-2016-0012

Status: published. Published: 2016-01-13. Updated: 2026-11-03.

Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office 2016, Excel 2016, PowerPoint 2016, Visio 2016, Word 2016, and Visual Basic 6.0 Runtime allow remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Microsoft Office ASLR Bypass."

## Remediation

No remediation reported in collected sources

## Affected products and versions

- n/a / n/a: Version not specified (affected). Source: CNA: microsoft

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 10.92% as of 2026-11-03; percentile 95.88%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004 (CNA: microsoft; vendor-advisory, x_refsource_MS)

- http://www.securitytracker.com/id/1034651 (CNA: microsoft; vdb-entry, x_refsource_SECTRACK)

- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004 (ADP: CVE; vendor-advisory, x_refsource_MS, x_transferred)

- http://www.securitytracker.com/id/1034651 (ADP: CVE; vdb-entry, x_refsource_SECTRACK, x_transferred)

## Provenance

- CNA: microsoft: https://www.cve.org/CVERecord?id=CVE-2016-0012; retrieved 2026-11-03; source updated 2026-11-03

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2016-0012; retrieved 2026-11-03; source updated Not reported

Revision: 7202d261058c061c742d2c0b084857f75d5abd48dbae6116dbf2831f9ce335ab

Canonical: https://y2.dev/cve/CVE-2016-0012

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.