CVE-2016-0147: Microsoft XML Core Services

High severity, CVSS 8.8. EPSS: 15.7% chance of exploitation in the next 30 days.

Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability."

Affected products

• Microsoft XML Core Services: version 3.0 only

Published 2016-04-12. Last modified 2026-06-17.