CVE-2020-0968: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

High severity · published Apr 15, 2020

CVE-2020-0968

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

RansomwareIn wildKEV

7.5

CVSS

30.7%

EPSS

Yes

On KEV

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)30.7% · higher than 98% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueMay 3, 2022

Ransomware campaign useKnown

Affected products

Which versions

Internet Explorer 11 · Microsoft

Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows 10 Version 1803 for ARM64-based Systems; Windows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 1809 for ARM64-based Systems; +16 more · source: vendor

Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems · Microsoft