CVE-2016-0189KEV · OVERDUE

Microsoft Internet Explorer Memory Corruption Vulnerability

High · published May 11, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1648
days past CISA
deadline
CVSS v3.1
7.5
EPSS
94%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 A clever crafted website is all it takes to trigger this nasty JScript and VBScript memory corruption vulnerability! ⚡ Think of it like a restaurant with a special dish that can poison the entire menu; just one bad order can compromise everyone dining there. In this case, an attacker can exploit the scripting engines lurking in Internet Explorer, causing chaos on your system. An attacker could execute arbitrary code remotely or even crash your browser, leading to a denial of service. This means they could take over your system and potentially steal sensitive information, leaving you vulnerable to further attacks. It's a digital nightmare waiting to happen!

Put simply

Think of it like a restaurant with a special dish that can poison the entire menu; just one bad order can compromise everyone dining there. In this case, an attacker can exploit the scripting engines lurking in Internet Explorer, causing chaos on your system. This vulnerability in the Microsoft JScript and VBScript engines allows for memory corruption, enabling attackers to run their code on affected versions of Internet Explorer 9 through 11, among other products. Essentially, it creates a backdoor for malicious activities through compromised web pages.

What to do

An attacker could execute arbitrary code remotely or even crash your browser, leading to a denial of service. This means they could take over your system and potentially steal sensitive information, leaving you vulnerable to further attacks. It's a digital nightmare waiting to happen! To protect yourself, ensure that your Internet Explorer is updated to the latest version. Microsoft has released patches, so check for updates and apply them immediately. If IE isn't necessary for your operations, consider disabling it altogether to minimize risk. You've got this! Follow these steps to secure your systems, and you'll be back in control in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.94062 · 99.8th percentile
Published
2016-05-11T01:00Z
KEV added
2022-03-28 · due 2022-04-18
EPSS history
Timeline
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev
  • 11 MAY 01:00Z
    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to…
    cvelistv5