CVE-2016-7288: Microsoft Edge scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution in a widely deployed browser with a very high EPSS score and public exploit code, though it requires user interaction and is not in KEV.

What it is

The scripting engines in Microsoft Edge contain a memory corruption flaw (CWE-119) that a crafted web page can trigger, leading to arbitrary code execution or a crash. It is one of several distinct scripting engine memory corruption issues patched in the same Microsoft update. Because it is reachable through normal browsing, it matters to any organization still running affected Edge builds.

Impact

An attacker who successfully triggers the flaw can execute arbitrary code in the context of the Edge process, or cause a denial of service through memory corruption. The CVSS 3.0 vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network by a victim visiting a crafted web site; no privileges are required but user interaction (browsing to the page) is needed per the CVSS vector AV:N/AC:H/PR:N/UI:R. The description does not specify which scripting engine component is at fault beyond the general scripting engines of Edge.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.70354, 99.35th percentile) and public exploit references exist, including an Exploit-DB entry and a Packet Storm write-up naming a TypedArray.sort use-after-free. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply Microsoft security update MS16-145 (December 2016) or a later cumulative update that supersedes it.
• Upgrade or migrate off affected Edge builds; the record does not list specific affected versions, so confirm against Microsoft's bulletin.
• Enforce browser hardening and block untrusted or unclassified sites where feasible.
• Keep endpoint protection and exploit mitigation features (such as ASLR/DEP and browser sandboxing) enabled.
• Track vendor advisories for any follow-up fixes to the same scripting engine component.

Detection

• Monitor for Edge renderer process crashes consistent with memory corruption, especially repeated crashes on the same host.
• Hunt proxy and DNS logs for access to known exploit-hosting or malformed-page infrastructure tied to this CVE.
• Review endpoint telemetry for suspicious child processes spawned by the Edge browser process.
• Check for the referenced public exploit artifacts (Exploit-DB 41357, Packet Storm TypedArray.sort use-after-free) in web or email content inspection logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.