CVE-2019-0667: microsoft internet_explorer Out-of-bounds Write
CVSS: 7.6v2.0HighModified
Published 08-04-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-0667 is a high (CVSS 7.6) Out-of-bounds Write vulnerability in microsoft internet_explorer. EPSS estimates a 31.26% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.6/10
010
High · v2.0 (NVD)EPSS score
31.26%
0%100%
High · -1.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Timeline
- 08-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0666, CVE-2019-0772.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesSingle source
High 7.6Preferred score · NVD (NIST)
AV:N/AC:H/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
31.26%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
-1.25 pp
From 32.51% on 21-09-2026
21-09-202621-10-2026
EPSS score31.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft VBScript - VbsErase Memory Corruption
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Microsoft4 products
- internet_explorerEOL9 | 10 | 11
- internet explorer 10Windows 7 for 32-bit Systems Service Pack 1 | Windows 7 for x64-based Systems Service Pack 1 | Windows Server 2008 R2 for x64-based Systems
- internet explorer 11Windows Server 2008 for x64-based Systems Service Pack 2
- internet explorer 9Windows Server 2008 for 32-bit Systems Service Pack 2
1 vendor · 4 products
References
1 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0667X Refsource CONFIRMPatchVendor Advisory