{"id":"CVE-2020-0674","published":"2020-02-11T22:15:14Z","modified":"2026-06-17T02:46:19Z","title":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","vendor":"Microsoft","product":"Internet Explorer","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.","provenance":"source","from":"NVD"},"summary":{"text":"A memory corruption flaw in the scripting engine of Microsoft Internet Explorer allows remote code execution because the engine mishandles objects in memory, with the flaw classed as a use-after-free. An attacker can exploit it over the network without authentication, but only if a user is induced to interact with attacker-controlled content, such as by visiting a crafted web page.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:00Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.86863,"percentile":0.99744,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0674","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-02-11","exploitedFirstSeen":"2020-02-11","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2020-Feb","date":"2020-02-11"},{"url":"https://blogs.360.cn/post/apt-c-06_0day.html","date":"2020-02-11"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2020-02-11"},{"url":"https://securelist.com/magnitude-exploit-kit-evolution/97436/","date":"2020-06-24"},{"url":"https://www.proofpoint.com/us/blog/threat-insight/purple-fox-ek-adds-exploits-cve-2020-0674-and-cve-2019-1458-its-arsenal","date":"2020-07-05"},{"url":"https://www.sentinelone.com/labs/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/","date":"2020-10-19"},{"url":"https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts","date":"2021-01-21"},{"url":"https://decoded.avast.io/martinchlumecky/dirtymoe-1/","date":"2021-06-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://ti.qianxin.com/uploads/2024/02/02/dcc93e586f9028c68e7ab34c3326ff31.pdf","date":"2024-02-02"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://packetstormsecurity.com/files/159137/Microsoft-Internet-Explorer-11-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161309/Microsoft-Internet-Explorer-11-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162565/Microsoft-Internet-Explorer-8-11-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/maxpl0it/CVE-2020-0674-Exploit","tags":["Exploit","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/159137/Microsoft-Internet-Explorer-11-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161309/Microsoft-Internet-Explorer-11-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162565/Microsoft-Internet-Explorer-8-11-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/maxpl0it/CVE-2020-0674-Exploit","tags":["Exploit","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0674","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Drive-by via malicious web content in browser","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer","start":0,"end":128}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Scripting engine memory corruption yields code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"remote code execution vulnerability exists in the way that the scripting engine handles objects in memory","start":2,"end":107}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-2167","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2167","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":49062,"url":"https://www.exploit-db.com/exploits/49062","title":"Microsoft Internet Explorer 11 - Use-After-Free","type":"local","platform":"windows","date":"2020-11-17","verified":false,"provenance":"source"},{"id":49863,"url":"https://www.exploit-db.com/exploits/49863","title":"Microsoft Internet Explorer 11 and WPAD service 'Jscript.dll' - Use-After-Free","type":"local","platform":"windows_x86-64","date":"2021-05-13","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2020-11-17"},"pocGithub":{"count":3,"skipped":1,"earliest":"2020-05-07","earliestUrl":"https://github.com/maxpl0it/CVE-2020-0674-Exploit","repos":[{"name":"maxpl0it/CVE-2020-0674-Exploit","url":"https://github.com/maxpl0it/CVE-2020-0674-Exploit","stars":222,"created":"2020-05-07"},{"name":"Neko-chanQwQ/CVE-2020-0674-PoC","url":"https://github.com/Neko-chanQwQ/CVE-2020-0674-PoC","stars":1,"created":"2021-07-03"},{"name":"Micky-Thongam/Internet-Explorer-UAF","url":"https://github.com/Micky-Thongam/Internet-Explorer-UAF","stars":0,"created":"2023-12-10"}]},"first":{"date":"2020-05-07","source":"PoC-in-GitHub","url":"https://github.com/maxpl0it/CVE-2020-0674-Exploit"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/159137/Microsoft-Internet-Explorer-11-Use-After-Free.html","http://packetstormsecurity.com/files/161309/Microsoft-Internet-Explorer-11-Use-After-Free.html","http://packetstormsecurity.com/files/162565/Microsoft-Internet-Explorer-8-11-Use-After-Free.html","https://github.com/maxpl0it/CVE-2020-0674-Exploit"],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-02-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0674","provenance":"source"},{"date":"2020-02-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2020-Feb","provenance":"source"},{"date":"2020-05-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2020-11-17","url":"https://github.com/maxpl0it/CVE-2020-0674-Exploit","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2167","provenance":"source"}],"speed":{"daysToPublicExploit":86,"firstExploitFrom":"PoC-in-GitHub","daysToKev":631},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2452 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9974"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 2 Exploit-DB entries; 3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-internet-explorer-cwe-416"}}