CVE-2019-0541

critical-risk
Published 2019-01-08

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.

Do I need to act?

!
83.4% chance of exploitation in next 30 days
EPSS score — higher than 17% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
46536
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (11)

Affected Vendors

Microsoft

References (7)

Broken Link http://www.securityfocus.com/bid/106402
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541
Exploit https://www.exploit-db.com/exploits/46536/
Broken Link http://www.securityfocus.com/bid/106402
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541
Exploit https://www.exploit-db.com/exploits/46536/
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-...
73
/ 100
critical-risk
Severity 30/34 · Critical
Exploitability 27/34 · High
Exposure 16/34 · Moderate