CVE-2020-0968KEV · OVERDUE

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

High · published April 15, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 98.2th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
7.5
EPSS
31%
Percentile
98.2
In the wild
Confirmed
What it is

🚨 A sneaky flaw in Internet Explorer's scripting engine lets attackers pull off remote code execution, simply by luring users to a malicious webpage! 🔥 Think of it as a restaurant where the chef unwittingly serves up a dish that contains hidden allergens — if you take a bite, it could cause disastrous effects! In this case, the browser handles memory objects in a way that allows malicious code to be executed remotely, much like a recipe going horribly wrong. An attacker can exploit this vulnerability to run arbitrary code on a user's system. This could lead to anything from data theft to complete system compromise — imagine a thief not only stealing your valuables but also rearranging your entire house!

Put simply

Think of it as a restaurant where the chef unwittingly serves up a dish that contains hidden allergens — if you take a bite, it could cause disastrous effects! In this case, the browser handles memory objects in a way that allows malicious code to be executed remotely, much like a recipe going horribly wrong. This vulnerability arises when the scripting engine improperly handles objects in memory, allowing for remote code execution when exploited by specially crafted web content.

What to do

An attacker can exploit this vulnerability to run arbitrary code on a user's system. This could lead to anything from data theft to complete system compromise — imagine a thief not only stealing your valuables but also rearranging your entire house! To protect yourself, immediately update Internet Explorer to the latest version to patch this vulnerability. Additionally, consider disabling the scripting engine if it's not essential for your browsing needs. Regularly check for security updates to stay safe! You've got this! Take these steps, and you'll be on your way to securing your system in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.30676 · 98.2th percentile
Published
2020-04-15T15:13Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 15 APR 15:13Z
    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory…
    cvelistv5