CVE-2018-8373KEV · OVERDUE

Microsoft Scripting Engine Memory Corruption Vulnerability

High · published August 15, 2018

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.2th percentile for exploit probability.

1652
days past CISA
deadline
CVSS v3.1
7.5
EPSS
62%
Percentile
99.2
In the wild
Confirmed
What it is

🚨 Internet Explorer’s scripting engine is throwing caution to the wind; it has a remote code execution vulnerability that’s been making waves! ⚡ Think of it like a library where the librarian lets anyone write and change the books without checking their credentials. A mischievous visitor can sneak in misleading information or even create chaos — not ideal for a public space! If an attacker exploits this vulnerability, they could execute any code they want, gaining control over your system. This means they could steal sensitive data, install malware, or even take over your computer completely — absolutely devastating!

Put simply

Think of it like a library where the librarian lets anyone write and change the books without checking their credentials. A mischievous visitor can sneak in misleading information or even create chaos — not ideal for a public space! The vulnerability arises from how the scripting engine mishandles objects in memory, allowing attackers to corrupt memory and execute arbitrary code when the browser processes a specially crafted webpage.

What to do

If an attacker exploits this vulnerability, they could execute any code they want, gaining control over your system. This means they could steal sensitive data, install malware, or even take over your computer completely — absolutely devastating! To protect yourself, patch Internet Explorer to the latest version, which is crucial for closing this security gap. Make sure your organization is aware of this vulnerability and educate users to avoid suspicious links and sites until they are updated. 🛡️ You’ve got this! Stay proactive and secure your environment — it’s totally fixable! 💪

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.61511 · 99.2th percentile
Published
2018-08-15T17:00Z
KEV added
2022-03-25 · due 2022-04-15
EPSS history
Timeline
  • 25 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 15
    kev
  • 15 AUG 17:00Z
    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory…
    cvelistv5