{"id":"CVE-2019-1429","published":"2019-11-12T19:15:14Z","modified":"2026-06-17T02:28:35Z","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","vendor":"Microsoft","product":"Internet Explorer","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a memory corruption vulnerability in the scripting engine of Microsoft Internet Explorer, where objects are mishandled in memory. An attacker can achieve remote code execution, and exploitation requires a user to interact with the attack, with no authentication needed and the attack vector being network-based (and of high complexity).","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:01Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.7729,"percentile":0.99554,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1429","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-11-12","exploitedFirstSeen":"2019-11-12","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Nov","date":"2019-11-12"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2019-11-12"},{"url":"https://securelist.com/magnitude-exploit-kit-evolution/97436/","date":"2020-06-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"},{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"http://packetstormsecurity.com/files/155433/Microsoft-Internet-Explorer-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/155433/Microsoft-Internet-Explorer-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1429","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Malicious web content triggers scripting engine via browser","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"remote code execution vulnerability exists in the way that the scripting engine","start":2,"end":81}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Memory corruption yields script-driven arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"scripting engine handles objects in memory in Internet Explorer","start":65,"end":128}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-9986","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9986","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":47707,"url":"https://www.exploit-db.com/exploits/47707","title":"Internet Explorer - Use-After-Free in JScript Arguments During toJSON Callback","type":"dos","platform":"windows","date":"2019-11-22","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-11-22"},"first":{"date":"2019-11-22","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/47707"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/155433/Microsoft-Internet-Explorer-Use-After-Free.html"],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-11-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1429","provenance":"source"},{"date":"2019-11-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2019-Nov","provenance":"source"},{"date":"2019-11-22","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-47707)","url":"https://www.exploit-db.com/exploits/47707","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9986","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"Exploit-DB","daysToKev":722},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2543 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9955"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-internet-explorer-cwe-416"}}