CVE-2016-0189
Microsoft Internet Explorer Memory Corruption Vulnerability
Description
CVE-2016-0189 is a critical memory corruption vulnerability (CWE-119) in the JScript and VBScript scripting engines of Microsoft Internet Explorer that allows remote code execution when a user visits a specially crafted web page. The vulnerability occurs when the scripting engines improperly handle objects in memory, allowing an attacker to execute arbitrary code in the context of the current user. CISA has confirmed active exploitation and included CVE-2016-0189 in the Known Exploited Vulnerabilities catalog. With an EPSS score of 91.2% (99.9th percentile), this vulnerability is among the most actively exploited browser flaws ever documented.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | jscript | 5.8 |
| microsoft | vbscript | 5.7; 5.8 |
| microsoft | internet explorer | 9; 10; 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/90012(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1035820(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051(Patch, Vendor Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-053(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/40118/(Third Party Advisory, VDB Entry)
- https://www.virusbulletin.com/virusbulletin/2017/01/journey-and-evolution-god-mode-2016-cve-2016-0189/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0189(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes a weakness where software performs operations on a memory buffer without properly restricting access to valid memory boundaries, leading to memory corruption, data leakage, or code execution. In CVE-2016-0189, the JScript and VBScript engines in Internet Explorer fail to correctly validate buffer boundaries during script execution, enabling attackers to corrupt process memory and achieve arbitrary code execution.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2016-0189 is remotely exploitable via a malicious web page and requires no authentication — the victim need only navigate to or be redirected to the page hosting the exploit. Successful exploitation grants the attacker full code execution with the privileges of the logged-in user, which frequently includes administrative rights on many Windows deployments. Confidentiality, integrity, and availability are all fully compromised: the attacker can exfiltrate sensitive data, deploy ransomware or other malware, modify system configurations, and establish persistent backdoor access. The 99.9th percentile EPSS score reflects this vulnerability's exceptional exploitation maturity, with weaponized exploit kits having integrated CVE-2016-0189 for years as a reliable Internet Explorer exploitation vector.
Exploit Maturity
CVE-2016-0189 is one of the most widely exploited browser vulnerabilities in history, with confirmed active exploitation documented by CISA in the KEV catalog. The vulnerability has been integrated into multiple commercial and open-source exploit kits, making it a standard component of drive-by download campaigns and watering hole attacks. The EPSS score of 91.2% (99.9th percentile) reflects the near-universal availability and use of working exploits. Full proof-of-concept exploit code has been publicly available since 2016, and the vulnerability continues to be exploited against legacy Internet Explorer installations.
Remediation
- Apply the Microsoft security update MS16-051 (May 2016) for Internet Explorer immediately to address CVE-2016-0189.
- Migrate from Internet Explorer to a modern browser such as Microsoft Edge (Chromium), Google Chrome, or Mozilla Firefox, as Internet Explorer has reached end of life and no longer receives security updates.
- If Internet Explorer must remain installed for legacy application compatibility, restrict its use through Group Policy and ensure Enhanced Security Configuration (ESC) is enabled on server systems.
- Deploy network-level protections including web content filtering, IDS/IPS signatures targeting known exploit kit traffic, and DNS-based blocking of known malicious domains.
- Conduct a thorough audit of all systems still running Internet Explorer to identify and prioritize migration paths for any remaining dependencies on the legacy browser.
Technical Details
CVE-2016-0189 is a memory corruption vulnerability (CWE-119) in the VBScript engine (vbscript.dll) used by Microsoft Internet Explorer. The flaw is triggered when the VBScript engine processes a specially crafted script that causes an array redimension operation to corrupt heap memory. Specifically, the vulnerability occurs in the handling of VBScript arrays where an attacker can manipulate the array descriptor to create a type confusion condition, enabling read and write access to arbitrary memory locations. This primitive allows the attacker to bypass ASLR and DEP protections by leaking memory addresses and constructing a ROP chain, ultimately achieving shellcode execution within the Internet Explorer process. The vulnerability is particularly dangerous because VBScript is enabled by default in Internet Explorer and executes automatically when embedded in web pages.
Frequently Asked Questions
Is CVE-2016-0189 being actively exploited?
Yes. CVE-2016-0189 is one of the most widely exploited browser vulnerabilities ever documented, with confirmed active exploitation in the CISA KEV catalog. It has been integrated into multiple exploit kits and used in drive-by download campaigns worldwide. The EPSS score of 91.2% (99.9th percentile) is among the highest recorded.
What products are affected by CVE-2016-0189?
CVE-2016-0189 affects the JScript and VBScript scripting engines in Microsoft Internet Explorer 9, 10, and 11 across multiple Windows versions. The vulnerability also affects standalone VBScript installations on Windows systems.
How do I fix CVE-2016-0189?
Apply the Microsoft security update MS16-051 (May 2016) for Internet Explorer. The most effective long-term remediation is migrating to a modern browser, as Internet Explorer has reached end of life. If IE must remain for compatibility, restrict its use via Group Policy.
How severe is CVE-2016-0189?
CVE-2016-0189 is rated CRITICAL and enables full remote code execution through a malicious web page. With the highest possible EPSS percentile (99.9th), widespread exploit kit integration, and CISA KEV listing, this is one of the most dangerous and extensively exploited browser vulnerabilities in the CVE database.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.