CVE-2018-0935: Internet Explorer Scripting Engine Memory Corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit and very high EPSS, but exploitation requires user interaction and the product is legacy.

What it is

Internet Explorer's scripting engine mishandles objects in memory, producing a use-after-free and out-of-bounds write. A remote attacker can corrupt memory and execute code in the context of the browser. The flaw affects IE across a wide range of Windows client and server releases.

Impact

Successful exploitation gives the attacker remote code execution with the privileges of the current user. On a system where the user has administrative rights, the attacker could take full control of the host.

Attack surface

Reached over the network via a crafted web page or content rendered by Internet Explorer; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so the victim must be lured into viewing the malicious content.

Exploitation

A public exploit exists (Exploit-DB 44404) and EPSS is high at 0.556 (99th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0935.
• Retire or stop using Internet Explorer; migrate browsing to a supported modern browser.
• Disable or restrict IE use on Windows Server and legacy Windows systems where it is not required.
• Enforce network controls and email/web filtering to block known exploit pages and malicious attachments.
• Run users with least privilege so code execution does not immediately yield administrative rights.

Detection

• Monitor for IE (iexplore.exe) crashes and abnormal child process creation, especially Office or script interpreters spawned by the browser.
• Hunt for known exploit artifacts and shellcode patterns tied to Exploit-DB 44404 in web proxy and endpoint logs.
• Alert on IE rendering of untrusted or newly registered domains and on exploit-kit redirect chains.
• Review endpoint telemetry for memory corruption indicators and suspicious post-exploitation behavior from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.