[ CVE-2019-0752 · Published 9 Apr 2019 ]
Microsoft Internet Explorer Type Confusion Vulnerability
Exploited · CISA KEV CVSS 7.5
EPSS 82%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-15
- Known to be used in ransomware campaigns
- EPSS: 82% chance of exploitation in the next 30 days (higher than 100% of CVEs)
[ Description ]Official description
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
CISA: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 15 Aug 2022): Apply updates per vendor instructions.
- Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/153078/Microsoft-Internet-Explorer-Windows-10-1809-17763.…ExploitThird Party AdvisoryVDB Entry
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0752PatchVendor Advisory
- www.zerodayinitiative.com/advisories/ZDI-19-359Third Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource