Memory corruption in Microsoft Edge - CVE-2016-7194

Vulnerability identifier: #VU858

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-7194

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into downloading it, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability will result in arbitrary code execution.

Microsoft Edge

Install update from vendor's website.

• Exploit #423 - Microsoft Edge - 'Function.apply' Information Leak (MS16-119) (March 18, 2020)

• https://technet.microsoft.com/en-us/library/security/ms16-119

• Multiple vulnerabilities in Microsoft Edge