Vulnerability record · CVE-2020-1380 · published 17 August 2020
CVE-2020-1380: Internet Explorer scripting engine memory corruption RCE
Microsoft · Internet Explorer
CVE-2020-1380 is an out-of-bounds write in the Internet Explorer scripting engine (jscript9.dll) that corrupts memory and allows arbitrary code execution in the context of the current user. It matters because IE is still present on many Windows systems and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a real-world target rather than a theoretical bug.
Description
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is a remotely reachable memory corruption bug with a KEV listing and high EPSS score, but exploitation requires reaching IE or an IE-hosting application and the CVSS base is 7.8 rather than critical.
What it is
CVE-2020-1380 is an out-of-bounds write in the Internet Explorer scripting engine (jscript9.dll) that corrupts memory and allows arbitrary code execution in the context of the current user. It matters because IE is still present on many Windows systems and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a real-world target rather than a theoretical bug.
Impact
An attacker who exploits it can run arbitrary code with the rights of the logged-on user, and if that user is an administrator, can take full control of the host, install software, alter or delete data, and create accounts.
Attack surface
Reached through the IE rendering engine: a crafted website, compromised or user-content site, or an ActiveX control marked safe for initialization embedded in an application or Office document. The CVSS vector is AV:L/PR:L/UI:N, so the record describes local access with low privileges and no user interaction, while the description also covers the web-based drive-by scenario.
Exploitation
Listed in CISA KEV (added 2021-11-03, due 2022-05-03) and EPSS 30-day probability 0.24188 (97.7th percentile), indicating observed exploitation. No ransomware campaign use is recorded and no public exploit tag appears in the references.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2020-1380.
- Disable or remove Internet Explorer and block IE rendering of untrusted content where business needs allow.
- Restrict or disable ActiveX controls, especially those marked safe for initialization, in IE and Office documents.
- Enforce least privilege so users do not run as local administrators, limiting the impact of code execution.
- Block or filter untrusted web content and advertisements that could deliver the exploit.
Detection
- Monitor for IE or jscript9.dll crashes and unexpected process creation from iexplore.exe or Office applications hosting the IE engine.
- Hunt for suspicious child processes spawned by iexplore.exe, winword.exe, excel.exe, or other Office binaries.
- Review proxy and web logs for access to known exploit-hosting or malvertising domains tied to IE scripting engine attacks.
- Check endpoint telemetry for memory corruption indicators and anomalous script execution in jscript9.dll.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-1380 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/163056/Internet-Explorer-jscript9.dll-Memory-Corruption.html | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380 | PatchVendor Advisory |
| http://packetstormsecurity.com/files/163056/Internet-Explorer-jscript9.dll-Memory-Corruption.html | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1380 | US Government Resource |
Track CVE-2020-1380 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-1380), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
