{"id":"CVE-2019-0676","published":"2019-03-05T23:29:02Z","modified":"2026-06-17T02:08:40Z","title":"Microsoft Internet Explorer Information Disclosure Vulnerability","vendor":"Microsoft","product":"Internet Explorer","tier":"core","eol":{"product":"Internet Explorer","since":"2022-06-15","note":"No security updates; remove it."},"description":{"text":"An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an information disclosure vulnerability in Microsoft Internet Explorer, arising from improper handling of objects in memory. An attacker who successfully exploits it can test for the presence of files on disk, and this requires only network access with no privileges, but it does need user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:08Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.0811,"percentile":0.94827,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-05-23","dueDate":"2022-06-13","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0676","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-02-12","exploitedFirstSeen":"2019-02-12","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Feb","date":"2019-02-12"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2019-02-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-23"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/106886","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/106886","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0676","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Browser exploitation via crafted web content","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory","start":0,"end":106}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1083","name":"File and Directory Discovery","tactics":["discovery"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Enumerates files on disk for presence","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could test for the presence of files on disk","start":165,"end":209}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-1436","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1436","exploited":true,"exploitedSince":"2022-05-23","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1083"],"provenance":"ai"}],"timeline":[{"date":"2019-02-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Feb","provenance":"source"},{"date":"2019-03-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0676","provenance":"source"},{"date":"2022-05-23","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1436","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1175},"priority":{"score":43.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2819 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.97,"detail":"percentile 0.9483"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]}}