CVE-2020-0968: Internet Explorer Scripting Engine Memory Corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a network-reachable RCE in a widely deployed component, listed in CISA KEV with known ransomware use and a high EPSS score, though exploitation requires user interaction.

What it is

Internet Explorer's scripting engine mishandles objects in memory, leading to an out-of-bounds write (CWE-787) that can be turned into remote code execution. The flaw is reachable over the network but requires a user to open a crafted page or document, making it a classic drive-by or lure-based attack. It matters because the affected component is widely deployed and the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who successfully triggers the memory corruption can execute arbitrary code in the context of the current user. Depending on the user's privileges, that can mean full control of the host, data theft, or further lateral movement.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R) — typically visiting a malicious or compromised web page or opening a crafted document that invokes the IE scripting engine. No authentication is needed to deliver the payload.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2022-05-03, and the KEV entry flags known ransomware campaign use. EPSS gives a 30-day exploitation probability of roughly 30.7% (98th percentile), indicating active interest.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) as the primary fix.
• Retire or disable Internet Explorer where possible; move users to a supported browser.
• Enforce IE hardening: disable ActiveX and scripting where not required, and use Enhanced Protected Mode / 64-bit IE.
• Block or restrict access to untrusted sites and documents through network and email filtering.
• Monitor CISA KEV guidance and confirm remediation by the listed due date.

Detection

• Hunt for IE (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe.
• Look for unusual outbound network connections originating from iexplore.exe or its child processes.
• Monitor for crashes or memory-corruption indicators in the IE scripting engine (e.g., jscript.dll / vbscript.dll) followed by process creation.
• Review proxy and DNS logs for known exploit-hosting or malvertising domains visited by IE clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.