CVE-2019-1367
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Description
CVE-2019-1367 is a high-severity memory corruption vulnerability in the Microsoft Internet Explorer scripting engine. The vulnerability exists in the way Internet Explorer handles objects in memory, allowing an attacker to execute arbitrary code in the context of the current user. An attacker could craft a specially designed website to exploit this out-of-bounds write flaw and gain the same user rights as the current user. CISA has confirmed active exploitation of this vulnerability in the wild and added it to the Known Exploited Vulnerabilities catalog. With an EPSS score of 89.69% (99.6th percentile) and known use in ransomware campaigns, CVE-2019-1367 represents a critical threat requiring immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 10; 11; 9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1367(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
The scripting engine in Microsoft Internet Explorer is affected by an out-of-bounds write vulnerability that occurs when it improperly handles objects in memory. Out-of-bounds write flaws allow software to write data beyond the intended boundaries of a buffer, potentially corrupting adjacent memory, overwriting control flow data, or enabling arbitrary code execution. In the context of Internet Explorer, this memory corruption can be triggered when a user visits a malicious web page.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2019-1367 carries a CVSS 3.1 score of 7.5 (HIGH), reflecting a significant threat to affected systems. The vulnerability is remotely exploitable over the network without requiring authentication, though exploitation demands high attack complexity and user interaction — typically requiring a user to visit a specially crafted website. Confidentiality (High): Successful exploitation can fully compromise the confidentiality of data accessible to the current user. Integrity (High): An attacker can modify or corrupt data and system settings within the user's privilege context. Availability (High): The vulnerability can be leveraged to disrupt system operations or crash the browser process. The EPSS score of 89.69% indicates near-certain exploitation activity, and the confirmed use in ransomware campaigns significantly amplifies the operational risk for organizations still running vulnerable Internet Explorer versions.
Exploit Maturity
CVE-2019-1367 is confirmed as actively exploited in the wild through its inclusion in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The vulnerability has also been associated with known ransomware campaigns, underscoring the severity and real-world impact of this flaw. The EPSS score of 89.69% (99.6th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most actively targeted flaws. While no dedicated public exploit entries are tagged in the NVD references, the confirmed in-the-wild exploitation and ransomware association demonstrate that threat actors have developed reliable exploitation techniques for this Internet Explorer scripting engine memory corruption vulnerability.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft has released security updates addressing CVE-2019-1367 through the Microsoft Security Response Center (MSRC).
- Update all affected Internet Explorer instances — versions 9, 10, and 11 are vulnerable. Verify that the cumulative security update corresponding to CVE-2019-1367 has been applied across all endpoints.
- Migrate away from Internet Explorer to a modern, supported browser such as Microsoft Edge, as Internet Explorer has reached end of life and no longer receives security updates.
- Implement network-level mitigations such as restricting Internet Explorer usage via Group Policy, blocking access to untrusted websites, and deploying web content filtering to reduce exposure to malicious sites targeting this vulnerability.
- Monitor endpoints for indicators of compromise including unusual scripting engine activity, unexpected process spawning from Internet Explorer, and signs of ransomware deployment. Review security logs and conduct threat hunting to determine if exploitation occurred prior to patching.
Technical Details
CVE-2019-1367 is a memory corruption vulnerability in the JScript scripting engine of Microsoft Internet Explorer, classified as an out-of-bounds write (CWE-787). The flaw resides in how the scripting engine handles objects in memory, where improper validation of memory boundaries during script execution allows data to be written beyond the allocated buffer. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-based attack vector requiring no privileges but needing user interaction, typically achieved by luring a victim to a malicious web page. The high attack complexity rating reflects the need for specific conditions to trigger the memory corruption reliably. Once triggered, the out-of-bounds write enables an attacker to corrupt critical memory structures, potentially hijacking execution flow to run arbitrary code with the same permissions as the logged-in user.
Frequently Asked Questions
Is CVE-2019-1367 being actively exploited?
Yes. CVE-2019-1367 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Additionally, this vulnerability has been associated with ransomware campaigns, indicating weaponized use by threat actors. The EPSS score of 89.69% (99.6th percentile) further confirms widespread exploitation activity.
What products are affected by CVE-2019-1367?
CVE-2019-1367 affects Microsoft Internet Explorer versions 9, 10, and 11. The vulnerability is in the JScript scripting engine, which is a core component of Internet Explorer. All systems running these versions are potentially at risk.
How do I fix CVE-2019-1367?
Apply the security updates provided by Microsoft through the MSRC advisory. Ensure all Internet Explorer instances across your environment are updated. Given that Internet Explorer has reached end of life, the recommended long-term fix is to migrate to a modern browser like Microsoft Edge and disable Internet Explorer where possible.
How severe is CVE-2019-1367?
CVE-2019-1367 has a CVSS 3.1 score of 7.5 (HIGH). While the base score reflects high attack complexity, the confirmed active exploitation, ransomware association, and EPSS score of 89.69% make this a critical priority for remediation. Successful exploitation enables remote code execution in the context of the current user.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.