CVE-2020-0674: Internet Explorer scripting engine use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is a remotely reachable memory-corruption flaw with public exploit code and confirmed exploitation per CISA KEV, despite the high attack complexity and required user interaction.

What it is

Internet Explorer's scripting engine mishandles objects in memory, producing a use-after-free (CWE-416) that can corrupt memory and lead to remote code execution. It matters because the flaw is remotely reachable, publicly exploited, and listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who triggers the corruption can execute code in the context of the affected Internet Explorer process, giving them the user's privileges on the host.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), typically a victim visiting a crafted page or opening attacker-supplied content in Internet Explorer.

Exploitation

CISA added it to KEV on 2021-11-03 with a 2022-05-03 remediation due, and EPSS shows a 30-day probability of 0.86863 (99.7th percentile); multiple references are tagged Exploit, including public proof-of-concept code.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) as the primary fix.
• Retire or disable Internet Explorer where possible and restrict browsing to supported browsers.
• Enforce Enhanced Security Configuration and other IE hardening for any remaining use.
• Block or tightly control access to untrusted web content and attachments on systems that still run IE.

Detection

• Hunt for Internet Explorer (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe, or script hosts, which is abnormal for normal browsing.
• Monitor for crashes or memory-corruption events in iexplore.exe and correlate with recent web or document access.
• Alert on network fetches of known exploit-hosting URLs or packetstorm/github exploit artifacts tied to this CVE.
• Review endpoint telemetry for IE processes loading unusual modules or making outbound connections after rendering untrusted content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.