CVE-2018-8373: Internet Explorer scripting engine out-of-bounds write enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution, is confirmed exploited in CISA KEV, and has very high EPSS, though it requires user interaction and affects a legacy browser.

What it is

CVE-2018-8373 is a memory corruption flaw (out-of-bounds write, CWE-787) in the Internet Explorer scripting engine affecting IE 9, 10 and 11. Because the engine mishandles objects in memory, a crafted page can corrupt memory and lead to remote code execution in the browser's context. It matters because IE remains present on many Windows systems and this flaw is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who successfully triggers the flaw can execute arbitrary code with the privileges of the user running Internet Explorer. That typically means full control of the affected workstation or, at minimum, code execution in the browser process.

Attack surface

Reached over the network via a web page or other content rendered by Internet Explorer; the CVSS vector shows no privileges required but user interaction required (UI:R), so a victim must open or view the malicious content. No authentication is needed on the attacker's side.

Exploitation

CVE-2018-8373 is listed in CISA KEV (added 2022-03-25), confirming exploitation in the wild, and EPSS gives a 30-day probability of roughly 0.62 (99th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) to all affected IE versions.
• Retire or disable Internet Explorer where possible and move users to a supported browser.
• Enforce CISA KEV remediation requirements if your organization is subject to them, given the 2022-04-15 due date.
• Restrict browsing to trusted sites and block untrusted ActiveX/script content via IE security zones and Enhanced Protected Mode.
• Keep Windows and browser components fully patched to prevent chaining with other flaws.

Detection

• Hunt for Internet Explorer (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for normal browsing.
• Monitor for crashes or memory-corruption indicators in IE/scripting engine processes on endpoints.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to IE exploit kits.
• Alert on unusual outbound connections originating from iexplore.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.