CVE-2016-7202: Microsoft Edge and IE Scripting Engine Memory Corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (7.5) with public exploit code and very high EPSS, though exploitation requires user interaction and the affected browsers are legacy.

What it is

The scripting engines in Internet Explorer 9 through 11 and Microsoft Edge contain a memory corruption flaw (CWE-119) that a crafted web page can trigger. Successful exploitation allows remote code execution or a denial of service. It is one of several related scripting engine bugs patched in late 2016.

Impact

An attacker can execute arbitrary code in the context of the browser process or crash it, giving code execution on the victim's machine or a denial of service.

Attack surface

Reached over the network via a crafted web site rendered by the affected browser; no authentication is required, but the victim must be convinced to visit the page (user interaction required per the CVSS vector).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.733, 99.4th percentile) and public Exploit-DB entries (40786, 40793) exist, indicating exploit code is publicly available.

What to do

• Apply Microsoft security updates MS16-129 and MS16-144 to patch the scripting engine.
• Upgrade or migrate off Internet Explorer 9-11 and unsupported Edge versions to a current, supported browser.
• Enforce browser isolation or sandboxing for legacy browser use where patching is not possible.
• Block or restrict access to untrusted web content and disable unnecessary scripting where feasible.

Detection

• Monitor for browser process crashes (iexplore.exe, MicrosoftEdge.exe) that may indicate memory corruption attempts.
• Hunt for exploit artifacts matching public PoCs (Exploit-DB 40786/40793) in proxy or endpoint telemetry.
• Alert on suspicious child processes spawned by the browser, a common post-exploitation indicator.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.