CVE-2018-0840: Internet Explorer and Edge scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability, high EPSS, and publicly available exploit code make this a serious risk for unpatched legacy Windows and browser deployments.

What it is

CVE-2018-0840 is an out-of-bounds write (CWE-787) in how the Microsoft scripting engine handles objects in memory, affecting Internet Explorer on Windows 7 SP1, Server 2008 R2 SP1, Windows 8.1/RT 8.1, Server 2012/R2, and Internet Explorer and Edge on Windows 10 and Server 2016. Successful exploitation allows remote code execution in the context of the current user. It is one of a large batch of scripting engine memory corruption fixes released together in February 2018.

Impact

An attacker who exploits the flaw can execute arbitrary code with the privileges of the logged-on user. If that user has administrative rights, the attacker could take full control of the host, including installing programs and modifying or deleting data.

Attack surface

The CVSS vector is network-reachable with no privileges required but user interaction required (AV:N/AC:H/PR:N/UI:R), consistent with a victim visiting a crafted web page or opening attacker-supplied content that triggers the scripting engine. No authentication is needed, but the victim must be induced to interact with the malicious content.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.53073, 98.9th percentile) and a public Exploit-DB entry (44077) exists, indicating exploit code is publicly available. No ransomware group usage is documented in the record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0840 as the first action.
• Prioritize patching systems still running Internet Explorer or Edge on the affected Windows versions, including Windows 7 SP1, Server 2008 R2 SP1, Windows 8.1/RT 8.1, Server 2012/R2, Windows 10, and Server 2016.
• Where legacy IE use is not required, restrict or disable it and enforce a modern, fully patched browser.
• Apply defense-in-depth controls such as EMET or Windows Defender Exploit Guard mitigations on hosts that cannot be patched immediately.
• Limit user privileges so that exploitation does not immediately yield administrative control.

Detection

• Monitor for browser or scripting engine crashes (iexplore.exe, MicrosoftEdge.exe, jscript.dll, vbscript.dll) that may indicate memory corruption attempts.
• Hunt for processes spawned by browser processes, especially unusual child processes such as cmd.exe, powershell.exe, or wscript.exe, which can indicate successful RCE.
• Review web proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to scripting engine exploits.
• Check endpoint telemetry for anomalous memory-write or heap manipulation behavior in browser processes on unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.