CVE-2020-0968
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Description
CVE-2020-0968 is a high-severity memory corruption vulnerability in Microsoft Internet Explorer. The flaw exists in the way Internet Explorer's scripting engine handles objects in memory, which can be exploited by an attacker to achieve remote code execution in the context of the current user. An attacker could craft a malicious webpage that, when visited by a victim, triggers the out-of-bounds write condition to execute arbitrary code. CISA has added CVE-2020-0968 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 33.41% (96.9th percentile), this Internet Explorer vulnerability has a significant probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 11; 9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0968(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0968(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a weakness where software writes data past the end or before the beginning of an intended buffer. In the case of CVE-2020-0968, Internet Explorer's scripting engine improperly manages memory when processing script objects, allowing an attacker to corrupt adjacent memory regions and redirect code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-0968 carries a CVSS 3.1 score of 7.5 (HIGH), reflecting a serious security threat. The vulnerability is remotely exploitable over the network, though exploitation requires high attack complexity and user interaction — a victim must navigate to a malicious webpage or open a crafted document. No authentication is needed to exploit this flaw. Confidentiality (High): Successful exploitation grants the attacker full read access to sensitive data on the affected system. Integrity (High): The attacker can modify or tamper with data, install malware, or alter system configurations. Availability (High): The attack can cause system crashes or service disruptions. With an EPSS score of 33.41%, there is a substantial likelihood of active exploitation, making prompt patching essential for organizations still running Internet Explorer.
Exploit Maturity
CVE-2020-0968 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog, which required federal agencies to apply remediation by 2022-05-03. The EPSS score of 33.41% (96.9th percentile) places this vulnerability well above the threshold for likely exploitation in the wild. While no dedicated public exploit code with an "Exploit" tag was identified in NVD references, the active exploitation status confirmed by CISA indicates that threat actors have developed working exploits for this Internet Explorer scripting engine memory corruption vulnerability.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Microsoft released security updates addressing this vulnerability in April 2020.
- Verify that all instances of Microsoft Internet Explorer (versions 9 and 11) have been updated to the latest patched versions. Consider migrating to a modern, supported browser such as Microsoft Edge.
- If immediate patching is not feasible, implement network-level protections by restricting access to untrusted websites, deploying web content filtering, and configuring browser security zones to block active scripting on untrusted sites.
- Monitor endpoints for indicators of compromise including unexpected process spawning from Internet Explorer, suspicious script execution, and anomalous memory access patterns. Review Windows Event Logs for related security events.
- As a long-term hardening measure, phase out Internet Explorer in favor of modern browsers with enhanced memory protection features such as Control Flow Guard (CFG) and Address Space Layout Randomization (ASLR).
Technical Details
CVE-2020-0968 is an out-of-bounds write vulnerability (CWE-787) in the scripting engine used by Microsoft Internet Explorer. The flaw arises when the scripting engine improperly handles objects in memory during script execution, leading to memory corruption that can be leveraged for arbitrary code execution. The CVSS vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-based attack vector with high attack complexity, requiring the victim to interact with a malicious resource such as a specially crafted web page. The scope is unchanged, meaning the impact is confined to the vulnerable component itself. This vulnerability is distinct from CVE-2020-0970, another scripting engine memory corruption issue patched in the same update cycle.
Frequently Asked Questions
Is CVE-2020-0968 being actively exploited?
Yes. CVE-2020-0968 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 33.41% (96.9th percentile) further indicates a high probability of exploitation activity.
What products are affected by CVE-2020-0968?
CVE-2020-0968 affects Microsoft Internet Explorer versions 9 and 11. Organizations running these versions on supported Windows operating systems should apply patches immediately.
How do I fix CVE-2020-0968?
Apply the security updates released by Microsoft in April 2020 per vendor instructions. If patching is not immediately possible, restrict access to untrusted websites and disable active scripting in Internet Explorer's security zones. Consider migrating to a modern browser.
How severe is CVE-2020-0968?
CVE-2020-0968 has a CVSS 3.1 score of 7.5 (HIGH). The vulnerability allows remote code execution through a crafted webpage, and its inclusion in the CISA KEV catalog underscores the urgency of remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.