CVE-2016-4324

What it actually does

Use-after-free condition triggered by stylesheet and superscript tokens in crafted RTF input allows arbitrary code execution in the affected document processor.

Why it matters to the business

Attackers can gain full control of systems that open malicious documents, leading to data theft, ransomware deployment, or persistent access with high operational disruption for any organization still using the vulnerable software.

How an attack unfolds

An attacker creates an RTF file containing specially crafted stylesheet and superscript tokens that trigger the use-after-free. The file is delivered to the victim (via email, download, or shared storage). When opened in the vulnerable application, the freed memory is reused for attacker-controlled code, resulting in arbitrary execution without further user interaction beyond opening the document.

How to fix it

Upgrade kine (Chainguard) and kine (Wolfi) to version 0.11.3-r2 or later. Remove or isolate any systems still running older versions until patches are applied.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases; attempt to open known-good and known-malicious RTF test files in a controlled environment to confirm the vulnerability is no longer present.

Typical attack path

1. Craft RTF file with stylesheet and superscript tokens that trigger use-after-free
2. Deliver file to target via email, web download, or file share
3. Victim opens the file in the vulnerable application
4. Use-after-free is triggered and attacker shellcode executes
5. Establish persistence, escalate privileges, or exfiltrate data

How to detect it

Search application and system logs for crashes or unexpected terminations immediately after RTF file opens; correlate with process creation events showing child shells or network activity from the document processor.

• LibreOffice process crash immediately after RTF open
• Unexpected child process spawned from soffice.bin or oosplash

What your security team should do

• Immediately inventory all instances of the affected packages and prioritize upgrade to 0.11.3-r2
• Block or sandbox RTF file handling from untrusted sources until patches are deployed
• Update detection rules to monitor for unexpected process behavior after RTF file access
• Review historical document-processing logs for any signs of prior exploitation given the multi-year exposure window