CVE-2019-1367: Internet Explorer scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable, code-execution flaw with confirmed KEV exploitation and ransomware use, though the CVSS 7.5 and required user interaction keep it below critical.

What it is

CVE-2019-1367 is an out-of-bounds write (CWE-787) in the Internet Explorer scripting engine that corrupts memory when handling objects. Successful exploitation allows remote code execution in the context of the affected user, and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog with documented ransomware campaign use.

Impact

An attacker can execute arbitrary code on the victim's machine with the privileges of the logged-in user, enabling malware installation, data theft or further lateral movement. Given the scripting engine context, code runs inside the browser process rather than requiring a separate privilege escalation.

Attack surface

Reached over the network (AV:N) through crafted content rendered by Internet Explorer's scripting engine, such as a malicious web page or hosted script. No authentication is required (PR:N), but exploitation requires user interaction (UI:R) because the victim must open or view the crafted content.

Exploitation

CISA added it to the KEV catalog on 2021-11-03 with known ransomware campaign use, and EPSS gives a 30-day probability of about 0.52 (98.9th percentile), indicating active real-world exploitation. The references include only vendor patch advisories and the CISA KEV entry, with no public exploit or PoC links provided.

What to do

• Apply the Microsoft security update for CVE-2019-1367 per the vendor advisory, prioritizing any system still running Internet Explorer.
• Retire or disable Internet Explorer where possible and move users to a supported browser.
• Enforce attack surface reduction and browser hardening controls that block script execution from untrusted sources.
• Restrict or block outbound access to untrusted sites and monitor for IE process spawning unusual child processes.
• Verify KEV remediation deadlines are met for internet-facing and user-workstation assets.

Detection

• Monitor for Internet Explorer (iexplore.exe) spawning unexpected child processes such as cmd.exe, powershell.exe or script hosts.
• Alert on memory corruption crash telemetry from the scripting engine, including repeated iexplore.exe crashes on the same host.
• Hunt for known exploitation artifacts and post-exploitation behavior tied to ransomware staging on endpoints running IE.
• Review proxy and DNS logs for access to sites delivering IE-targeted exploit content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.