CVE-2019-0541
Microsoft MSHTML Remote Code Execution Vulnerability
Description
CVE-2019-0541 is a high-severity remote code execution vulnerability in the Microsoft MSHTML engine caused by improper input validation. The MSHTML engine, used by Internet Explorer and Microsoft Office products, fails to properly validate input, allowing an attacker to execute arbitrary code in the context of the current user. CISA has confirmed active exploitation of this vulnerability by adding it to the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 80.94% (99.1st percentile), there is a very high probability of exploitation activity, making immediate remediation critical.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 11; 9; 10 |
| microsoft | excel viewer | 2007 |
| microsoft | office | 2010; 2013; 2016; 2019 |
| microsoft | office 365 proplus | - |
| microsoft | office word viewer | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/106402(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/46536/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0541(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
In the context of CVE-2019-0541, the MSHTML engine fails to properly neutralize user-supplied input, allowing an attacker to inject and execute commands. This improper input validation in the rendering engine enables remote code execution when a user opens specially crafted content in Internet Explorer or affected Microsoft Office applications.
Learn more: CWE-77 — Command Injection
Impact Analysis
CVE-2019-0541 carries a CVSS 3.1 score of 8.8 (HIGH), representing a serious security threat across multiple Microsoft products. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication, though user interaction is required to trigger the exploit. Confidentiality (High): an attacker can gain full access to sensitive data within the context of the current user. Integrity (High): complete modification of data and system configurations is possible. Availability (High): full disruption of the affected service or system can occur. The EPSS score of 80.94% (99.1st percentile) indicates a near-certain probability of active exploitation, and the wide range of affected products — including Internet Explorer 9, 10, and 11, Microsoft Office 2010 through 2019, and Office 365 ProPlus — significantly increases the attack surface for organizations.
Exploit Maturity
CVE-2019-0541 has a mature exploit landscape with confirmed active exploitation. CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-05-03. Public exploit code is available for CVE-2019-0541 via Exploit-DB, significantly lowering the barrier for attackers. The EPSS score of 80.94% (99.1st percentile) indicates a near-certain probability of exploitation activity, placing this vulnerability among the most likely to be exploited. Ransomware usage has not been specifically associated with this vulnerability, but the availability of public exploits and the broad product surface make it an attractive target for various threat actors.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install the latest security updates from the Microsoft Security Response Center.
- Verify that all instances of affected products have been updated: Internet Explorer (versions 9, 10, 11), Microsoft Office (2010, 2013, 2016, 2019), Office 365 ProPlus, Microsoft Excel Viewer 2007, and Microsoft Office Word Viewer.
- As an interim mitigation, restrict the MSHTML engine's ability to process untrusted content by disabling ActiveX controls and active scripting in Internet Explorer security zones, and by blocking Office documents from opening embedded web content.
- Implement input validation at the network perimeter using web application firewalls (WAF) and email security gateways to detect and block specially crafted payloads targeting the MSHTML engine.
- Monitor endpoint systems for suspicious process execution originating from Internet Explorer or Office applications, such as unexpected child processes or network connections initiated by document rendering engines.
Technical Details
CVE-2019-0541 exploits an improper input validation flaw in the Microsoft MSHTML rendering engine, which is the core HTML parser and rendering component used by Internet Explorer and embedded in Microsoft Office applications for document rendering. The vulnerability is classified under CWE-77 (Command Injection), where specially crafted input is not properly neutralized before being processed by the engine, enabling an attacker to execute arbitrary commands. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows that exploitation occurs over the network with low complexity and no privilege requirements, though user interaction — such as opening a malicious document or visiting a crafted webpage — is necessary. The broad attack surface spans Internet Explorer 9 through 11 and multiple Office versions from 2010 to 2019, as the MSHTML engine is shared across these products for HTML content processing.
Frequently Asked Questions
Is CVE-2019-0541 being actively exploited?
Yes. CVE-2019-0541 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available on Exploit-DB, and the EPSS score of 80.94% (99.1st percentile) indicates a near-certain probability of exploitation activity.
What products are affected by CVE-2019-0541?
CVE-2019-0541 affects a wide range of Microsoft products that use the MSHTML engine. Specifically affected are: Internet Explorer (versions 9, 10, 11), Microsoft Office (2010, 2013, 2016, 2019), Office 365 ProPlus, Microsoft Excel Viewer 2007, and Microsoft Office Word Viewer.
How do I fix CVE-2019-0541?
Apply updates per vendor instructions by installing the latest Microsoft security updates for all affected products. As interim measures, disable ActiveX controls and active scripting in Internet Explorer, and restrict Office documents from opening embedded web content. Monitor for suspicious process activity from browser and Office applications.
How severe is CVE-2019-0541?
CVE-2019-0541 has a CVSS 3.1 score of 8.8 (HIGH) with full impact on confidentiality, integrity, and availability. The EPSS score of 80.94% places it in the 99.1st percentile for exploitation probability, making it one of the most likely vulnerabilities to be actively exploited.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.