CVE-2018-8353: Internet Explorer Scripting Engine Use-After-Free Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityA public exploit and very high EPSS probability make this a realistic target for unpatched IE users, though the required user interaction and lack of KEV listing keep it below critical.

What it is

Internet Explorer's scripting engine mishandles objects in memory, producing a use-after-free (CWE-416) that can corrupt memory and allow remote code execution. The flaw affects Internet Explorer 9, 10 and 11, and because IE is a widely deployed browser, a crafted page can compromise a victim who simply visits it. Microsoft addressed it in the August 2018 security update.

Impact

An attacker who successfully exploits the memory corruption can execute arbitrary code in the context of the current user. If that user has administrative rights, the attacker could take full control of the host, including installing programs, changing data, or creating accounts with full rights.

Attack surface

Reached over the network through a web page or other content rendered by Internet Explorer's scripting engine; the CVSS vector shows no privileges required but user interaction required, so the victim must open or view the malicious content. No authentication is needed on the attacker's side.

Exploitation

A public exploit exists (Exploit-DB 45279) and EPSS is high at 0.6769 (99.3rd percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Apply the Microsoft August 2018 security update referenced in the MSRC advisory for CVE-2018-8353.
• Retire or block Internet Explorer where possible and standardize users on a supported modern browser.
• Enforce Enhanced Protected Mode / Protected Mode and other IE hardening settings on any remaining IE deployments.
• Restrict or disable unnecessary IE scripting and ActiveX features via group policy and attack surface reduction rules.
• Limit user privileges so a successful exploit does not immediately yield administrative control.

Detection

• Monitor for IE (iexplore.exe) spawning unexpected child processes such as cmd.exe, powershell.exe or script hosts.
• Hunt for crashes or memory corruption events in IE and its scripting components on endpoints.
• Review proxy and DNS logs for known exploit-hosting or malvertising domains delivering IE-targeted pages.
• Alert on Exploit-DB 45279 or related PoC signatures in network and endpoint detection content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.