CVE-2020-0674
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Description
CVE-2020-0674 is a high-severity memory corruption vulnerability in the Microsoft Internet Explorer scripting engine that allows remote code execution. The vulnerability exists in the way the scripting engine handles objects in memory, enabling an attacker to execute arbitrary code in the context of the current user by luring them to a specially crafted webpage. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.64% (99.84th percentile), CVE-2020-0674 is among the most likely vulnerabilities to be actively exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 9; 10; 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/159137/Microsoft-Internet-Explorer-11-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161309/Microsoft-Internet-Explorer-11-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162565/Microsoft-Internet-Explorer-8-11-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/maxpl0it/CVE-2020-0674-Exploit(Exploit, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0674(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (UAF) is a vulnerability that occurs when software continues to reference memory after it has been freed, potentially allowing an attacker to corrupt data or execute arbitrary code. In the context of CVE-2020-0674, the Internet Explorer scripting engine (JScript) improperly handles objects in memory, creating a use-after-free condition that an attacker can exploit to gain code execution through a specially crafted webpage.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2020-0674 carries a CVSS 3.1 score of 7.5 (HIGH), representing a significant threat to organizations running Internet Explorer. The vulnerability is remotely exploitable over the network, though it requires high attack complexity and user interaction to trigger. No authentication is required, meaning any user visiting a malicious webpage is potentially at risk. Confidentiality (High): an attacker can gain full access to sensitive data within the user's context. Integrity (High): complete modification of files and system data is possible. Availability (High): full disruption of the browser and potentially the underlying system can occur. The EPSS score of 93.64% (99.84th percentile) indicates an extremely high probability of exploitation, placing this vulnerability at the top of the exploitation likelihood spectrum. While the higher attack complexity somewhat limits opportunistic exploitation, the confirmed active exploitation and widespread availability of exploit code make this a critical remediation priority.
Exploit Maturity
CVE-2020-0674 has a highly mature exploit landscape with extensive public exploitation resources. CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-05-03. Public exploit code is available through multiple sources, including Packet Storm Security (IE 11 Use-After-Free), Packet Storm Security (IE 11 UAF variant), Packet Storm Security (IE 8-11 UAF), and a GitHub exploit repository. The EPSS score of 93.64% (99.84th percentile) confirms near-certain exploitation probability. While ransomware usage has not been specifically associated with this vulnerability, the abundance of public exploit code and confirmed active exploitation make immediate patching essential.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install the latest security update from the Microsoft Security Response Center.
- Verify that all instances of Microsoft Internet Explorer (versions 9, 10, and 11) have been updated to the patched version across the organization.
- As an interim mitigation, restrict access to the JScript scripting engine by modifying the access control list (ACL) for jscript.dll. This can prevent the vulnerable component from being loaded while maintaining browser functionality through the newer JScript9 engine.
- Migrate users from Internet Explorer to a modern, supported browser such as Microsoft Edge to eliminate the attack surface entirely. Configure group policies to prevent Internet Explorer usage for general browsing.
- Deploy endpoint detection and response (EDR) monitoring rules to detect use-after-free exploitation patterns, including anomalous memory access patterns from Internet Explorer, unexpected child process creation, and shellcode execution indicators.
Technical Details
CVE-2020-0674 is a use-after-free vulnerability (CWE-416) in the JScript scripting engine used by Microsoft Internet Explorer versions 9, 10, and 11. The vulnerability occurs when the scripting engine improperly manages the lifecycle of objects in memory, freeing an object while references to it still exist. When the dangling pointer is subsequently dereferenced, the attacker-controlled data in the freed memory region can redirect execution flow to arbitrary code. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that exploitation occurs remotely over the network but requires high attack complexity, as the attacker must precisely manipulate heap layout and timing to reliably exploit the freed memory. User interaction is required, typically in the form of navigating to a malicious webpage containing JavaScript that triggers the use-after-free condition in the JScript engine. This vulnerability is related to several other scripting engine memory corruption vulnerabilities, including CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, and CVE-2020-0767.
Frequently Asked Questions
Is CVE-2020-0674 being actively exploited?
Yes. CVE-2020-0674 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploit implementations are available on Packet Storm Security and GitHub, and the EPSS score of 93.64% (99.84th percentile) indicates near-certain exploitation probability.
What products are affected by CVE-2020-0674?
CVE-2020-0674 affects Microsoft Internet Explorer versions 9, 10, and 11. Any Windows system with these Internet Explorer versions installed is potentially vulnerable, even if Internet Explorer is not the default browser.
How do I fix CVE-2020-0674?
Apply updates per vendor instructions by installing the latest Microsoft security update for Internet Explorer. As an interim mitigation, restrict access to jscript.dll to prevent the vulnerable scripting engine from loading. For long-term protection, migrate users to a modern browser like Microsoft Edge and disable Internet Explorer through group policy.
How severe is CVE-2020-0674?
CVE-2020-0674 has a CVSS 3.1 score of 7.5 (HIGH) with full impact on confidentiality, integrity, and availability. The EPSS score of 93.64% (99.84th percentile) places it among the most likely vulnerabilities to be exploited. While the higher attack complexity slightly reduces opportunistic risk, the abundance of public exploits and confirmed active exploitation make this a high-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.