CVE-2018-8653: high-severity vulnerability in Microsoft Internet Explorer 9
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
Internet Explorer's scripting engine incorrectly handles objects in memory, allowing an attacker to execute arbitrary code remotely by crafting a malicious webpage. This is a critical flaw because it bypasses the browser's security protections.
Memory corruption vulnerability in the scripting engine of IE 9, 10, and 11 enables remote code execution when a user visits a malicious webpage containing crafted objects. The attack requires user interaction (visiting the webpage) and succeeds due to improper memory handling in object processing, leading to full system compromise.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.