CVE-2016-0189highunder attackransomwareCWE-787

CVE-2016-0189

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 94%
from disclosure to weapon42 days
Published on NVDMay 11
1st PoC+42d
metasploitMay 10
CISA KEV+2147d
Action required by CISAfederal deadline: 2022-04-18

Apply updates per vendor instructions.

In short

A flaw in Microsoft's JScript and VBScript engines used by Internet Explorer allows attackers to run malicious code or crash the browser by visiting a specially designed website.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in JScript 5.8 and VBScript 5.7/5.8 engines used in Internet Explorer 9-11. Remote attacker delivers crafted HTML/script via web page; no authentication required. Results in arbitrary code execution or denial of service through memory corruption.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.