CVE-2019-0752: Internet Explorer scripting engine type confusion RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is a remotely reachable RCE in Internet Explorer with public exploit code, KEV listing and documented ransomware use, so exploitation is both feasible and impactful.

What it is

Internet Explorer's scripting engine mishandles objects in memory, a type confusion (CWE-843) that corrupts memory and can lead to remote code execution. It matters because the flaw is remotely reachable, has a public exploit reference, and is listed in CISA KEV with known ransomware campaign use.

Impact

An attacker who triggers the flaw can execute arbitrary code in the context of the affected user, giving full control of the process and potentially the host.

Attack surface

Reached over the network via a crafted web page or content rendered by Internet Explorer; the CVSS vector shows no privileges required but user interaction required (UI:R), so a victim must open or view the malicious content.

Exploitation

CISA KEV lists it as exploited with known ransomware campaign use, and EPSS is very high (0.81551, 99.6th percentile); a public exploit reference exists on Packet Storm.

What to do

• Apply the Microsoft security update for CVE-2019-0752 per the vendor advisory.
• Retire or disable Internet Explorer where possible and block its use for untrusted web content.
• Enforce Enhanced Security Configuration or equivalent hardening for any remaining IE usage.
• Block or alert on known exploit delivery paths and restrict access to untrusted sites.
• Track KEV remediation due date (2022-08-15) and confirm patched status across the estate.

Detection

• Hunt for Internet Explorer processes spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Monitor for crashes or memory corruption events in IE scripting engine components.
• Review proxy and DNS logs for access to known exploit or malicious hosting referenced in threat intel.
• Correlate endpoint alerts for type confusion exploitation patterns with IE usage on unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.