CVE-2020-0878
Microsoft Edge and Internet Explorer Memory Corruption Vulnerability
Description
CVE-2020-0878 is a memory corruption vulnerability in Microsoft Edge and Internet Explorer with a CVSS 3.1 score of 4.2 (MEDIUM) from the vendor assessment and 7.5 (HIGH) from NVD. The vulnerability exists in the way that Microsoft browsers access objects in memory and could corrupt memory to allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploits the vulnerability could gain the same user rights as the current user. Affected products include Microsoft Internet Explorer (versions 9 and 11), Microsoft Edge (Legacy), and ChakraCore. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The vulnerability is known to be leveraged in ransomware campaigns. With an EPSS score of 0.05268 (89.85th percentile), this vulnerability shows notable real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 11; 9 |
| microsoft | edge | - |
| microsoft | chakracore | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0878(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0878(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2020-0878 is classified under CWE-787 — Out-of-bounds Write. Out-of-bounds Write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. This can happen through buffer overflows, incorrect array indexing, pointer arithmetic errors, or integer overflows affecting size calculations. Out-of-bounds writes are extremely dangerous as they can corrupt adjacent data, overwrite control flow information, modify security flags, or corrupt heap metadata.
In the context of Microsoft Edge and Internet Explorer, this weakness is especially concerning because browser memory corruption vulnerabilities provide a direct path to code execution through carefully crafted web content. Attackers can host malicious pages or inject content into legitimate sites to trigger the vulnerability, requiring only that a victim visits the compromised page. Browser-based out-of-bounds write vulnerabilities consistently rank among the most dangerous due to the broad attack surface and the potential for drive-by exploitation.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-0878 has vendor-assessed CVSS score of 4.2 (MEDIUM) and an NVD-assessed CVSS score of 7.5 (HIGH) with Unchanged Scope.
Confidentiality (LOW to HIGH): Depending on the assessment source, successful exploitation could grant limited to extensive access to data in the browser context, including session cookies, cached credentials, and data from open web applications.
Integrity (LOW to HIGH): Attackers can potentially modify data within the browser process, install malware if combined with privilege escalation, or alter web application behavior.
Availability (NONE to HIGH): The impact on availability ranges from none to complete disruption of the browser process, depending on the exploitation technique used.
Scope Unchanged: The vulnerability's scope is contained within the browser process. However, successful code execution in the browser context could serve as a stepping stone for further system compromise.
With an EPSS score of 0.05268 (89.85th percentile), this vulnerability is actively targeted and should be remediated promptly, especially given its ransomware association.
Exploit Maturity
CVE-2020-0878 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited in the wild. The memory corruption flaw in the browser scripting engine provides attackers with a reliable exploitation vector through crafted web pages. The vulnerability was patched in September 2020 as part of Microsoft's Patch Tuesday updates.
Ransomware association: This vulnerability is known to be leveraged in ransomware campaigns. Browser-based remote code execution vulnerabilities are commonly used as initial access vectors in ransomware attack chains, often combined with privilege escalation exploits for full system compromise.
Attack surface: The vulnerability affects Microsoft Internet Explorer and legacy Microsoft Edge, which remain in use across many enterprise environments. Exploitation requires the victim to visit a malicious or compromised website. Attackers can leverage watering hole attacks, malvertising, or phishing emails with malicious links.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03.
Remediation
- Apply the September 2020 Microsoft security update immediately. Apply updates per vendor instructions. Consult the Microsoft Security Advisory at MSRC for specific patch guidance.
- Identify all systems running affected browser versions. Verify that all instances of Internet Explorer (versions 9 and 11), legacy Microsoft Edge, and ChakraCore are identified in your environment. Use software inventory tools to ensure complete coverage.
- Migrate away from Internet Explorer and legacy Edge. Transition to modern browsers such as Chromium-based Microsoft Edge, which is not affected by this vulnerability. Disable Internet Explorer where it is not required for business-critical applications.
- Implement browser security controls. Enable Enhanced Protected Mode in Internet Explorer, deploy Content Security Policy headers on internal web applications, and consider using browser isolation solutions for high-risk browsing activities.
- Deploy network-level protections. Configure web proxies and firewalls to block known malicious domains. Use DNS filtering to prevent access to exploitation infrastructure. Enable Microsoft Defender SmartScreen for URL reputation checking.
- Monitor for exploitation indicators. Configure endpoint detection tools to alert on suspicious browser process behavior, unexpected child processes spawned by browser processes, and network connections to known malicious infrastructure.
Technical Details
CVE-2020-0878 is a memory corruption vulnerability in Microsoft browsers that can be exploited remotely over the network. The attack complexity is high according to the vendor assessment, meaning specific conditions must be met for exploitation. No prior authentication or privileges are needed. User interaction is required, meaning a victim must visit a malicious website or open crafted content.
Technical mechanism: The vulnerability exists in how Microsoft browsers (Internet Explorer and legacy Edge) access objects in memory through their scripting engines. A specially crafted web page can trigger an out-of-bounds write condition in the browser's memory, corrupting adjacent data structures. By carefully controlling the memory layout, an attacker can overwrite critical data to redirect code execution. The attacker hosts the crafted page on a web server and convinces the victim to visit it, either through phishing, watering hole attacks, or malicious advertisements.
CVSS 3.1 vector analysis: The vendor vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) scores 4.2, reflecting High Attack Complexity and Low Confidentiality/Integrity impact with No Availability impact. The NVD assessment (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.5, reflecting HIGH impact across all dimensions.
Affected products: Microsoft Internet Explorer (versions 9 and 11), Microsoft Edge (Legacy), ChakraCore.
Frequently Asked Questions
Is CVE-2020-0878 being actively exploited?
Yes, CVE-2020-0878 is actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has an EPSS score of 0.05268 (89.85th percentile). The vulnerability is known to be leveraged in ransomware campaigns as an initial access vector.
What products are affected by CVE-2020-0878?
Affected products include Microsoft Internet Explorer (versions 9 and 11), Microsoft Edge (Legacy), and ChakraCore. Modern Chromium-based Microsoft Edge is not affected. Organizations still running Internet Explorer or legacy Edge should prioritize migration.
How do I fix CVE-2020-0878?
Apply the September 2020 Microsoft security update from MSRC. Migrate away from Internet Explorer and legacy Edge to modern Chromium-based browsers. Implement browser isolation and network-level protections as defense-in-depth measures.
How severe is CVE-2020-0878?
CVE-2020-0878 has a vendor CVSS score of 4.2 (MEDIUM) and an NVD CVSS score of 7.5 (HIGH). Its EPSS score of 0.05268 places it in the 89.85th percentile for exploitation likelihood. The vulnerability enables remote code execution through crafted web pages and is confirmed in ransomware campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.