Microsoft Windows Media Center Remote Code Execution Vulnerability
CVE-2016-0185 is a security vulnerability in Microsoft Windows, added to CISA KEV on November 3, 2021. Patch priority: Plan to patch.
What it is
Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.
Who's affected
Affects anyone running Windows workstations or servers. In a small CPA, legal, or dental practice, Windows is typically the platform your accounting, document management, or practice management software runs on — exploitation gives an attacker access to whatever client files and credentials live on those machines.
What to do
Apply updates per vendor instructions.
If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Book a free 20-minute triage call.
Insurance readiness
Your insurer will ask if this is patched.
Unpatched entries on CISA's Known Exploited Vulnerabilities list are exactly what cyber-insurance carrier questionnaires probe for, and knowing which controls they check is how you keep a renewal from stalling.
Get the free carrier questionnaire →Severity
CVSS base score: 7.8 — HIGH
Microsoft fix
- KB3150220 (Security Update)
Microsoft Exploitability Index (assessed at update release): N/A
Microsoft did not classify exploitability for this CVE. CISA still lists it as actively exploited.
Vendor workaround
Vendor-published workaround
Remove the MCL file association
To use the interactive method: Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.
- Click Start, click Run, type regedit, and then click OK.
- Expand HKEY_CLASSES_ROOT, click .MCL, and then click the File menu and select Export.
- In the Export Registry File dialog box, type MCL HKCR file association registry backup.reg and click Save. This will create a backup of this registry key in the My Documents folder by default.
- Press the Delete key to delete the registry key. When prompted to delete the registry value, click Yes.
- Expand HKEY_CURRENT_USER, then Software, then Microsoft, then Windows, then CurrentVersion, then Explorer, and then FileExts.
- Click .MCL, and then click the File menu and select Export.
- In the Export Registry File dialog box, type MCL HKCU file association registry backup.reg and click Save. This will create a backup of this registry key in the My Documents folder by default.
- Press the Delete key to delete the registry key. When prompted to delete the registry value, click Yes.
To use the managed deployment script method:
- Make a backup copy of the registry keys from a managed deployment script using the following commands:
Regedit.exe /e MCL_HKCR_registry_backup.reg HKEY_CLASSES_ROOT\.MCL
Regedit.exe /e MCL_HKCU_registry_backup.reg HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MCL
- Save the following to a file with a .reg extension (for example, Delete_MCL_file_association.reg):
[-HKEY_CLASSES_ROOT\.MCL]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
FileExts\.MCL]
- Run the registry script that you created in Step 2 on the target machine using the following command:
Regedit.exe /s Delete_EXTENSION_file_association.reg
How to undo the workaround.
- Restore the registry key by using Regedit to restore the settings saved in the .REG file.
A workaround reduces exposure while you patch — it is not a substitute for the update. Install the fix above as soon as you can.
CISA due date
Federal deadline: May 3, 2022. Federal agencies must complete the required action by this date. For private SMBs the deadline is advisory — but treat it as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).
EPSS
EPSS score: 69.9% — higher than 99% of all scored CVEs.
EPSS estimates the probability of exploitation activity in the next 30 days. Every entry on this site is already confirmed exploited, so read it as relative urgency among the things you still have open, not as permission to wait.
Other exploited Microsoft Windows entries
More CISA KEV entries for Microsoft Windows. Same product line, same actively-exploited status.
Source
This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.