Microsoft Internet Explorer and Edge Information Disclosure Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-24
• Known to be used in ransomware campaigns
• EPSS: 26% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

CISA: An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 14 Jun 2022): Apply updates per vendor instructions.

• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.securityfocus.com/bid/92788Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1036788Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1036789Broken LinkThird Party AdvisoryVDB Entry
• docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104PatchVendor Advisory
• docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-105PatchVendor Advisory
• www.brokenbrowser.com/detecting-apps-mimetype-malwareExploit
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource