CVE-2021-26411KEV · OVERDUECWE-416

Microsoft Internet Explorer Memory Corruption Vulnerability

High · published March 11, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.6th percentile for exploit probability.

1802
days past CISA
deadline
CVSS v3.1
8.8
EPSS
82%
Percentile
99.6
In the wild
Confirmed
What it is

🚨 A single crafted web page could lead to full remote code execution in Internet Explorer! This memory corruption vulnerability is a serious threat that you can't ignore! 🔥 Think of it like a restaurant accepting any dish without checking the order. If the chef doesn't review what's on the ticket, they might serve up something unexpected — or even harmful to diners! An attacker can exploit this vulnerability to execute arbitrary code on your system, potentially gaining control and accessing sensitive information. This means they could modify data, install software, or even carry out actions on behalf of the user without permission — absolutely devastating!

Put simply

Think of it like a restaurant accepting any dish without checking the order. If the chef doesn't review what's on the ticket, they might serve up something unexpected — or even harmful to diners! This memory corruption vulnerability occurs when Internet Explorer improperly handles objects in memory, allowing attackers to execute arbitrary code if a user visits a malicious webpage.

What to do

An attacker can exploit this vulnerability to execute arbitrary code on your system, potentially gaining control and accessing sensitive information. This means they could modify data, install software, or even carry out actions on behalf of the user without permission — absolutely devastating! Update to the latest version of Internet Explorer as soon as possible to patch this vulnerability. Also, consider disabling Internet Explorer entirely if alternatives are available, as this will minimize your attack surface. Keep an eye on your system for any suspicious activities. You've got this! Stay proactive and secure your systems from this threat! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.81667 · 99.6th percentile
Weakness
CWE-416 · Use After Free
Published
2021-03-11T21:15Z
KEV added
2021-11-03 · due 2021-11-17
Affected products (3)
ProductVersionsFixed in
microsoft/edgeall versions—
microsoft/internet_explorerall versions—
microsoft/internet_explorerall versions—
References (3)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 11 MAR 15:07Z
    Internet Explorer Memory Corruption Vulnerability
    cvelistv5