Memory corruption in Microsoft products - CVE-2016-0187

Vulnerability identifier: #VU5076

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-0187

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Microsoft JScript
VBScript
Microsoft Internet Explorer

Install update from vendor's website.

• https://technet.microsoft.com/en-us/library/security/ms16-051.aspx
• https://technet.microsoft.com/en-us/library/security/ms16-053.aspx

• Multiple vulnerabilities in Microsoft Internet Explorer
• Two remote code execution vulnerabilities in Microsoft JScript and VBScript
• Scripting Engine Memory Corruption Vulnerability
• Security Update for JScript and VBScript