Is CVE-2016-8386 actively exploited?

No active exploitation of CVE-2016-8386 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2016-8386 be exploited remotely?

No. CVE-2016-8386 requires local access to exploit.

What is the CVSS score of CVE-2016-8386?

CVE-2016-8386 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2016-8386

HIGH

CVE-2016-8386

CWE-787Published: February 27, 2017· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a PDF containing a malformed font to XML, the tool will attempt to use a size out of the font to search through a linked list of buffers to return. Due to a signedness issue, a buffer smaller than the requested size will be returned. Later when the tool tries to populate this buffer, the overflow will occur which can lead to code execution under the context of the user running the tool.

NVD Source

Technical Analysis

CVE-2016-8386 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.