High severity · published Jun 16, 2016
CVE-2016-3202
The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute…
7.5
CVSS
17.4%
EPSS
No
On KEV
Description
The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)17.4% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CJ
Chakra Javascript · Microsoft
All versions, or not specified · source: NVD
JS
Jscript · Microsoft
All versions, or not specified · source: NVD
VB
Vbscript · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3202
www.securitytracker.com
http://www.securitytracker.com/id/1036096
www.securitytracker.com
http://www.securitytracker.com/id/1036099
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-068