CVE-2016-0189: Microsoft JScript and VBScript engines memory corruption in Internet Explorer

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and public exploit code exists, so unpatched IE systems face active exploitation risk.

What it is

The JScript 5.8 and VBScript 5.7/5.8 engines used by Internet Explorer 9 through 11 contain an out-of-bounds write that corrupts memory when a crafted web page is processed. A remote attacker can trigger it through browsing, leading to arbitrary code execution or a denial of service. It is a distinct issue from CVE-2016-0187 and was patched in May 2016.

Impact

Successful exploitation lets an attacker execute arbitrary code in the context of the affected scripting engine, or crash the browser. In practice this yields code execution on the victim's machine under the user's privileges.

Attack surface

Reached over the network by a victim visiting a crafted web site or opening attacker-supplied content that invokes the vulnerable scripting engine. No authentication is required, but user interaction (browsing to or opening the page) is needed per the CVSS vector.

Exploitation

Listed in CISA KEV since 2022-03-28 with known ransomware campaign use, and EPSS is very high (0.94, 99.8th percentile). Public exploit code exists (Exploit-DB 40118) and a detailed write-up describes its use.

What to do

• Apply the Microsoft updates referenced in MS16-051 and MS16-053, or later cumulative updates, to affected Windows and IE installations.
• Retire or upgrade Internet Explorer 9 through 11 where possible; migrate users to a supported browser.
• Restrict or block execution of legacy JScript/VBScript content and untrusted ActiveX/scripting in IE via policy.
• Enforce network controls and email/web filtering to block known exploit hosts and malicious attachments.
• Monitor for and isolate systems that cannot be patched, given confirmed ransomware use.

Detection

• Hunt for IE processes (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe or rundll32.exe.
• Alert on script engine crashes or memory-corruption events in jscript.dll/vbscript.dll from IE.
• Review proxy and DNS logs for connections to known exploit-kit or malicious domains tied to this CVE.
• Correlate endpoint telemetry for exploit artifacts and post-exploitation behavior on hosts still running IE 9-11.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.