How to Fix CVE-2016-0034: Remote Code Execution in Silverlight

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-05-25, federal due date 2022-06-15.

What is CVE-2016-0034?

CVE-2016-0034 is a remote code execution flaw in Microsoft Silverlight 5, the browser plugin and application runtime Microsoft shipped for rich web media and XAP applications. The Silverlight decoder mishandles negative offsets while decoding content. A crafted offset drives the runtime to write past the bounds of a managed object's header, corrupting the object header in memory. An attacker who controls that corruption can pivot it into arbitrary code execution inside the browser process that hosts the plugin, or simply crash it for a denial of service. Microsoft tracks the same bug as the "Silverlight Runtime Remote Code Execution Vulnerability" in bulletin MS16-006.

This is a client-side flaw, not a server flaw. It is reached entirely through the browser: a victim visits a web page that embeds a malicious Silverlight object, the page hands attacker-controlled data to the vulnerable decode path, and the negative-offset bug does the rest. That is why the CVSS vector carries UI:R (user interaction required) and AV:N (network/web reachable). No credentials are needed (PR:N), and a successful hit yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H) within the user's security context, which is how the base score lands at 8.8.

Microsoft did not assign a CWE for this record. Mechanically it is an out-of-bounds write driven by improper validation of a signed offset value, which corrupts adjacent object-header memory before the attacker steers it into code execution.

Why this CVE matters

CISA added CVE-2016-0034 to the Known Exploited Vulnerabilities catalog on 2022-05-25, six years after disclosure, because real attack code targeting it was still in use. Silverlight RCE bugs are attractive to exploit-kit operators: the runtime sat inside browsers across large enterprise and consumer fleets for years, and many of those installs were never removed even after Microsoft stopped shipping new features. A drive-by page that loads a malicious XAP can compromise a workstation without any download prompt the user would recognize as dangerous.

If Silverlight 5 below build 5.1.41212.0 is still installed anywhere in your fleet and the host browses the open web, treat any window of unpatched exposure as compromise-likely. The realistic posture in 2026 is not just to patch but to remove Silverlight entirely, since the runtime reached end of support on 12 October 2021 and no browser besides legacy Internet Explorer modes still loads it.

Identify which hosts are affected

Silverlight installs as a Windows program and a browser plugin. It was never distributed as a Linux .deb or .rpm package, so there is nothing to check with dpkg or rpm here. Query the installed Silverlight build directly. Any build below 5.1.41212.0 is vulnerable.

# Read the Silverlight build straight from the registry (fast, no WMI scan)
$paths = @(
  'HKLM:\SOFTWARE\Microsoft\Silverlight',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Silverlight'
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    (Get-ItemProperty $p).Version | ForEach-Object { "Silverlight build: $_" }
  }
}
# If the build is below 5.1.41212.0, this host needs MS16-006 (or removal).

# Fleet check: is the MS16-006 update (KB3126036) present?
Get-HotFix -Id KB3126036 -ErrorAction SilentlyContinue

How to fix CVE-2016-0034

The fixed build is Silverlight 5.1.41212.0, delivered by update KB3126036 under bulletin MS16-006. There are two valid paths: patch to the fixed build, or remove Silverlight outright. Removal is the better choice now that the runtime is end of life.

Option A, patch to the fixed build (Windows)

# Vendor advisory: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-006
# The fastest supported path is Windows Update, which delivers KB3126036.
Install-Module -Name PSWindowsUpdate -Force -SkipPublisherCheck -Confirm:$false
Import-Module PSWindowsUpdate
Get-WindowsUpdate -KBArticleID KB3126036
Install-WindowsUpdate -KBArticleID KB3126036 -AcceptAll -AutoReboot

# Or apply a standalone package downloaded from the Microsoft Update Catalog:
wusa.exe C:\Patches\windows6.x-kb3126036.msu /quiet /norestart

# Confirm the update landed
Get-HotFix -Id KB3126036

After installing, fully close and reopen every browser so no process keeps the old Silverlight runtime mapped in memory.

Option B. remove Silverlight (recommended, it is end of life)

Silverlight reached end of support on 12 October 2021 and is not supported on any modern browser. If nothing in your environment still depends on a Silverlight line-of-business app, uninstalling it removes the attack surface permanently.

# Find the Silverlight uninstall registration and run its uninstaller silently
$keys = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
                       'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -EA SilentlyContinue
$sl = $keys | ForEach-Object { Get-ItemProperty $_.PSPath } |
      Where-Object { $_.DisplayName -match 'Silverlight' }
$sl.DisplayName; $sl.UninstallString

# Silverlight's MSI product code uninstall (silent):
Start-Process msiexec.exe -ArgumentList "/x $($sl.PSChildName) /qn /norestart" -Wait -EA SilentlyContinue

# Verify it is gone
Test-Path 'HKLM:\SOFTWARE\Microsoft\Silverlight'   # should return False after removal

If you can't patch or remove immediately

Patching to 5.1.41212.0 or uninstalling is the only durable fix. Because this is a browser-delivered client-side bug, the meaningful interim mitigations are about stopping Silverlight content from loading, not firewalling a server port.

• Disable the Silverlight add-on in the browser. In Internet Explorer, Manage Add-ons > Toolbars and Extensions, disable "Microsoft Silverlight". Modern Chrome, Firefox, and Edge already refuse to load NPAPI plugins like Silverlight, so they are not exposed.
• Block the plugin by policy with the kill-bit / add-on management Group Policy so users cannot re-enable it.
• Use the Microsoft Update Catalog as a fallback if WSUS or Windows Update cannot reach the host: download KB3126036 and apply it offline with wusa.exe as shown above.

# Disable the Silverlight browser add-on machine-wide via the IE add-on kill list.
# Silverlight CLSID: {DFEAF541-F3E1-4C24-ACAC-99C30715084A}
$clsid = '{DFEAF541-F3E1-4C24-ACAC-99C30715084A}'
$base  = 'HKLM:\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility'
New-Item -Path "$base\$clsid" -Force | Out-Null
# Compatibility Flags 0x00000400 sets the kill bit so IE refuses to instantiate the control.
Set-ItemProperty -Path "$base\$clsid" -Name 'Compatibility Flags' -Value 0x00000400 -Type DWord

Confirm the fix landed

Re-read the Silverlight build and confirm it is 5.1.41212.0 or higher, or that Silverlight is no longer present at all.

# Build should be >= 5.1.41212.0, or the key should be absent if you uninstalled.
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Silverlight' -EA SilentlyContinue).Version
Get-HotFix -Id KB3126036 -EA SilentlyContinue

Run an authenticated vulnerability scan with a current signature set and confirm the scanner no longer flags CVE-2016-0034 on the host. For machines that browsed the open web while running a build below 5.1.41212.0, review endpoint detection and proxy logs over that exposure window for malicious Silverlight content, unexpected child processes spawned from the browser, and any persistence (new scheduled tasks, autoruns, or outbound connections) that appeared during the window.

Frequently asked questions

Which Silverlight build fixes CVE-2016-0034?

Silverlight 5.1.41212.0, delivered by update KB3126036 under Microsoft bulletin MS16-006. Any Silverlight 5 build below 5.1.41212.0 is vulnerable.

Is this a server-side vulnerability I need to patch on web servers?

No. CVE-2016-0034 is a client-side flaw in the Silverlight browser runtime. It is triggered when a user's browser loads a malicious Silverlight object on a crafted web page. The fix and the risk both live on the endpoint that has Silverlight installed, not on your web servers.

Should I patch Silverlight or just remove it?

Remove it if you can. Silverlight reached end of support on 12 October 2021 and is not supported by any current browser, so it provides no benefit on most fleets while remaining an exploitable attack surface. Only keep and patch it if a legacy line-of-business application still requires the runtime.

Is CVE-2016-0034 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25, which means confirmed active exploitation. The CVE's primary references do not link a public proof-of-concept, but the KEV listing means working attack code is in use, so treat weaponization as certain.

References

• Official vendor advisory: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-006
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2016-0034
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0034
• Additional reference: http://www.securitytracker.com/id/1034655
• Additional reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0034

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other CVEs touching related code paths, worth patching together with this one:

• How to Fix CVE-2016-7262: Security vulnerability in Microsoft Office
• How to Fix CVE-2016-0165: Security Vulnerability in Win32K
• How to Fix CVE-2016-3393: Security Vulnerability in Windows
• How to Fix CVE-2016-0189: Out-of-Bounds Write in Microsoft Internet Explorer
• How to Fix CVE-2016-0040: n/a in Microsoft Windows