{"id":"CVE-2015-2419","published":"2015-07-14T21:59:33Z","modified":"2026-06-17T00:24:04Z","title":"Microsoft Internet Explorer Memory Corruption Vulnerability","vendor":"Microsoft","product":"Internet Explorer","tier":"core","eol":{"product":"Internet Explorer","since":"2022-06-15","note":"No security updates; remove it."},"description":{"text":"JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"JScript9 Memory Corruption Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"A memory corruption flaw in the JScript 9 scripting engine of Microsoft Internet Explorer 10 and 11 can be triggered by crafted web content. An attacker who gets a user to visit a malicious web site, with no authentication required, could execute arbitrary code or cause a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:20Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.5298,"percentile":0.98973,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2419","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-07-21","exploitedFirstSeen":"2015-07-21","ransomware":true,"evidence":[{"url":"https://resources.infosecinstitute.com/topic/the-hacking-team-hack-when-hackers-have-become-the-target/","date":"2015-07-21"},{"url":"https://securelist.com/it-threat-evolution-in-q3-2015/72493/","date":"2015-11-02"},{"url":"https://securelist.com/kaspersky-security-bulletin-2015-overall-statistics-for-2015/73038/","date":"2015-12-15"},{"url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/teslacrypt-arrives-via-neutrino-exploit-kit/","date":"2016-03-15"},{"url":"https://www.oreilly.com/content/threat-intelligence-and-ransomware/","date":"2016-12-13"},{"url":"https://blog.malwarebytes.com/cybercrime/2017/08/rig-exploit-kit-distributes-princess-ransomware/","date":"2017-08-31"},{"url":"https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf","date":"2018-02-04"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-28"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://www.securitytracker.com/id/1032894","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-065","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1032894","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-065","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2419","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Drive-by compromise through malicious website visit","mappingType":"uncategorized","evidence":[{"from":"description","quote":"via a crafted web site","start":150,"end":172}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: JScript execution yields arbitrary code","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary code or cause a denial of service","start":78,"end":129}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"UG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN\r\n2018 2017 2016 2015 2014\r\nCVE-2013-4979\r\nCVE-2013-4979\r\nCVE-2015-5122\r\nCVE-2016-4117\r\nCVE-2014-8439\r\nCVE-2016-1019\r\nCVE-2015-5119\r\nCVE-2015-2419","start":8871,"end":9191}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-2512","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-2512","exploited":true,"exploitedSince":"2022-03-28","provenance":"source"},"exploits":[{"id":44743,"url":"https://www.exploit-db.com/exploits/44743","title":"Microsoft Internet Explorer 11 - javascript Code Execution","type":"local","platform":"windows","date":"2016-02-01","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-02-01"},"first":{"date":"2016-02-01","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/44743"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059.007"],"provenance":"ai"},{"stage":"related","techniques":["T1189"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-07-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2419","provenance":"source"},{"date":"2015-07-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://resources.infosecinstitute.com/topic/the-hacking-team-hack-when-hackers-have-become-the-target/","provenance":"source"},{"date":"2016-02-01","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-44743)","url":"https://www.exploit-db.com/exploits/44743","provenance":"source"},{"date":"2022-03-28","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-2512","provenance":"source"}],"speed":{"daysToPublicExploit":202,"firstExploitFrom":"Exploit-DB","daysToKev":2449},"priority":{"score":67.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4118 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.79,"detail":"percentile 0.9897"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-microsoft-internet-explorer-cwe-787"}}