CVE-2016-7287: Microsoft IE and Edge scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution in widely used browsers with public exploit code and very high EPSS, though user interaction is required and no KEV listing exists.

What it is

The scripting engines in Internet Explorer 11 and Microsoft Edge contain a memory corruption flaw (CWE-119) that a crafted web site can trigger. Successful exploitation allows arbitrary code execution or a denial of service. It matters because both browsers were widely deployed and the flaw is remotely reachable through normal browsing.

Impact

An attacker can execute arbitrary code in the context of the browser process, or crash it to cause a denial of service. Code execution would run with the privileges of the logged-on user.

Attack surface

Reached over the network via a crafted web site rendered by IE 11 or Edge; the CVSS vector shows no privileges required but user interaction required, meaning the victim must visit or open the malicious page. No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.68884, 99.3rd percentile) and public exploit code exists on Exploit-DB (40948) and Packet Storm, indicating mature public exploitation.

What to do

• Apply the Microsoft security updates MS16-144 (Internet Explorer) and MS16-145 (Edge) immediately.
• Upgrade or migrate off Internet Explorer 11 to a supported browser.
• Enforce browser isolation or sandboxing for untrusted web content.
• Block or restrict access to known exploit-hosting sites and untrusted content via web filtering.
• Keep Edge and Windows fully patched to prevent regression to this class of bug.

Detection

• Monitor for browser process crashes (iexplore.exe, MicrosoftEdge.exe) that correlate with visits to untrusted sites.
• Hunt for suspicious child processes spawned by browser processes, a common post-exploitation indicator.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains.
• Enable and alert on exploit mitigation events (EMET/Exploit Guard) tied to browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.