CVE-2019-0752

Microsoft Internet Explorer 11, Microsoft Internet Explorer 10

Published 9 Apr 2019 · updated 12 Aug 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 15 Feb 2022, with a remediation deadline of 15 Aug 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.

References

packetstormsecurity.com/files/153078/Microsoft-Internet-Explorer-Windows-10-1809-17763.316-Memory-Corruption.html · Exploit, Third Party Advisory, VDB Entry
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0752 · Patch, Vendor Advisory
www.zerodayinitiative.com/advisories/ZDI-19-359/ · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0752 · US Government Resource