CVE-2020-0674KEV · OVERDUE

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

High · published February 11, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.5
EPSS
87%
Percentile
99.7
In the wild
Confirmed
What it is

🚨 A crafty flaw in Internet Explorer's scripting engine lets attackers execute code remotely! 🔥 Think of this vulnerability like a chef who leaves the kitchen door wide open, allowing anyone to waltz in and cook whatever they want; what’s simmering could be chaos! 🍳 An attacker could take complete control of your system, running malicious code and potentially stealing sensitive information. This could lead to data breaches, unauthorized access, or even a total system takeover - absolutely devastating!

Put simply

Think of this vulnerability like a chef who leaves the kitchen door wide open, allowing anyone to waltz in and cook whatever they want; what’s simmering could be chaos! 🍳 This remote code execution vulnerability occurs due to improper handling of objects in memory by the scripting engine in Internet Explorer. When exploited, it can allow an attacker to run arbitrary code with the same permissions as the user.

What to do

An attacker could take complete control of your system, running malicious code and potentially stealing sensitive information. This could lead to data breaches, unauthorized access, or even a total system takeover - absolutely devastating! To protect yourself, make sure to update Internet Explorer to the latest version as per Microsoft's advisories. Additionally, consider disabling the scripting engine if you don't need it for your day-to-day tasks. You've got this! Follow these steps and you'll have your defenses up in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.86863 · 99.7th percentile
Published
2020-02-11T21:22Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 11 FEB 21:22Z
    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory…
    cvelistv5