Buffer overflow in Microsoft Internet Explorer - CVE-2020-0674

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2020-0674

Links to Public Exploits and PoC-codes

• Exploit #9425 - Internet-Explorer-UAF (Porting the CVE-2020-0674 exploit for Windows8.1 and Windows10) (December 13, 2023)
• Exploit #6569 - CVE-2020-0674-PoC (随便放点自己弄的小东西) (July 26, 2021)
• Exploit #6509 - CVE-2020-0674-PoC (随便放点自己弄的小东西) (July 4, 2021)
• Exploit #5648 - Microsoft Internet Explorer 11 - Use-After-Free (June 17, 2021)
• Exploit #5617 - Microsoft Internet Explorer 11 32-bit - Use-After-Free (June 17, 2021)
• Exploit #5456 - Microsoft Internet Explorer 8/11 and WPAD service 'Jscript.dll' - Use-After-Free (May 20, 2021)
• Exploit #5148 - Microsoft Internet Explorer 11 Use-After-Free (February 12, 2021)
• Exploit #4673 - CVE-2020-0674 () (September 30, 2020)
• Exploit #4597 - Internet Explorer 11 - Use-After-Free (September 14, 2020)
• Exploit #4506 - CVEs (Some exploits and pocs.) (August 21, 2020)
• Exploit #2824 - CVE-2020-0674 (Info about CVE-2020-0674) (June 3, 2020)
• Exploit #2633 - CVE-2020-0674-Exploit (This is an exploit for CVE-2020-0674 that runs on the x64 version of IE 8, 9, 10, and 11 on Windows 7.) (May 8, 2020)

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200001
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674

Related Security Bulletins

• Remote code execution in Microsoft Internet Explorer
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler