CVE-2020-1380
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Description
CVE-2020-1380 is a high-severity memory corruption vulnerability in the Microsoft Internet Explorer scripting engine. The vulnerability exists in the way the scripting engine handles objects in memory within the jscript9.dll component, allowing an attacker to achieve remote code execution in the context of the current user. An attacker could exploit this Internet Explorer vulnerability by convincing a user to visit a specially crafted website or by embedding a malicious ActiveX control in an Office document. CISA has added CVE-2020-1380 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 91.73% (99.5th percentile), this out-of-bounds write vulnerability poses a significant threat to organizations still using Internet Explorer 11.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/163056/Internet-Explorer-jscript9.dll-Memory-Corruption.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1380(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
The jscript9.dll scripting engine in Microsoft Internet Explorer 11 is affected by an out-of-bounds write vulnerability in how it handles objects in memory. Out-of-bounds write flaws enable software to write data beyond the intended buffer boundaries, which can corrupt adjacent memory regions, overwrite control flow structures, and ultimately enable arbitrary code execution. In Internet Explorer, this memory corruption is triggered through malicious script execution when visiting a crafted web page.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-1380 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a severe threat to systems running Internet Explorer 11. The vulnerability is classified with a local attack vector because exploitation typically requires user interaction — opening a malicious document or visiting a crafted website — but has low attack complexity, meaning no special conditions are needed beyond luring the user. Confidentiality (High): Successful exploitation provides the attacker with full access to data accessible to the current user, potentially including credentials, documents, and sensitive business information. Integrity (High): An attacker can modify, delete, or plant malicious data on the affected system, install backdoors, or alter system configurations. Availability (High): The vulnerability can be used to crash systems or deploy destructive payloads that disrupt normal operations. The EPSS score of 91.73% indicates near-certain exploitation activity. While this vulnerability is not currently associated with ransomware campaigns, the high EPSS score and confirmed active exploitation make immediate patching essential.
Exploit Maturity
CVE-2020-1380 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-01-10. A detailed technical write-up and memory corruption proof-of-concept is available via Packet Storm Security, providing insight into the exploitation technique targeting the jscript9.dll component. The EPSS score of 91.73% (99.5th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted Internet Explorer vulnerabilities. The combination of confirmed in-the-wild exploitation and public technical analysis demonstrates that reliable exploitation techniques exist for this scripting engine memory corruption flaw.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft has released a cumulative security update addressing CVE-2020-1380 through the MSRC advisory.
- Update all systems running Internet Explorer 11 to the latest cumulative update. Verify patch deployment across all endpoints, particularly those used for web browsing or document processing.
- Migrate away from Internet Explorer to Microsoft Edge or another modern browser. Internet Explorer 11 has reached end of life for most Windows versions and no longer receives security updates.
- Restrict jscript9.dll execution through registry modifications or Group Policy where Internet Explorer must remain installed for compatibility purposes. Block ActiveX controls in Office documents via Group Policy to prevent exploitation through embedded content.
- Monitor for indicators of compromise including unusual process behavior from iexplore.exe, unexpected DLL loading in browser processes, and anomalous outbound network connections from Internet Explorer. Review endpoint detection and response (EDR) logs for suspicious scripting engine activity and conduct threat hunting to identify potential pre-patch exploitation.
Technical Details
CVE-2020-1380 is a memory corruption vulnerability in the jscript9.dll component of Microsoft Internet Explorer 11, classified as an out-of-bounds write (CWE-787). The flaw stems from improper handling of objects in memory during JavaScript execution, where boundary validation failures allow writing beyond allocated buffer regions. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates exploitation requires user interaction — typically visiting a malicious web page or opening a document with an embedded ActiveX control — but has low complexity once the user is engaged. The jscript9.dll component is the JavaScript engine used by Internet Explorer 11, and the memory corruption occurs during the processing of specially crafted JavaScript objects. The out-of-bounds write can corrupt heap metadata or adjacent objects, which an attacker can leverage through heap grooming techniques to achieve predictable memory layouts and redirect execution to attacker-controlled code.
Frequently Asked Questions
Is CVE-2020-1380 being actively exploited?
Yes. CVE-2020-1380 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 91.73% (99.5th percentile) indicates near-certain exploitation activity. Technical details and proof-of-concept code are publicly available.
What products are affected by CVE-2020-1380?
CVE-2020-1380 affects Microsoft Internet Explorer 11. The vulnerability is in the jscript9.dll scripting engine component. All Windows systems running Internet Explorer 11 are potentially at risk, including those where IE11 is installed but not used as the default browser.
How do I fix CVE-2020-1380?
Apply the cumulative security update from Microsoft as described in the MSRC advisory. The most effective long-term remediation is migrating to a modern browser like Microsoft Edge, as Internet Explorer 11 has reached end of life. If IE11 must remain installed, restrict script execution and disable ActiveX controls where possible.
How severe is CVE-2020-1380?
CVE-2020-1380 has a CVSS 3.1 score of 7.8 (HIGH). The vulnerability enables remote code execution through the Internet Explorer scripting engine. With confirmed active exploitation and an EPSS score of 91.73%, this is a high-priority vulnerability requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.