peter bassill · operator
$ cve CVE-2019-1429 JSON

CVE-2019-1429 KEV EXPLOIT

7.5
HIGH · CVSS 3.1 · EPSS 77.3% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.

Scoring

CVSS7.5 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS77.29% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-416
On CISA KEVyes — remediate by 2022-05-03
Public exploityes
Published2019-11-12
Last modified2026-06-17

CISA KEV

NameMicrosoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Added2021-11-03
Due2022-05-03
Vendor / productMicrosoft / Internet Explorer
Ransomware usenone reported

Affected (14)

VendorProduct
microsoftinternet explorer
microsoftwindows 10 1507
microsoftwindows 10 1607
microsoftwindows 10 1709
microsoftwindows 10 1803
microsoftwindows 10 1809
microsoftwindows 10 1903
microsoftwindows 7
microsoftwindows 8.1
microsoftwindows rt 8.1
microsoftwindows server 2008
microsoftwindows server 2012
microsoftwindows server 2016
microsoftwindows server 2019

Public exploits

SourceTitleDate
exploit-dbInternet Explorer - Use-After-Free in JScript Arguments During toJSON Callback2019-11-22

References

→ the Explorer  ·  watch your stack  ·  NVD