CVE-2020-0674: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

How it works

CVE-2020-0674 is a memory corruption vulnerability in the Scripting Engine of Microsoft Internet Explorer. It is classified as CWE-416 (use-after-free). In this class of flaw, the engine mishandles objects in memory so that a reference to freed memory can still be used. An attacker who can cause the browser to process specially crafted content can corrupt memory state and potentially achieve remote code execution in the security context of the logged-on user.

Public detail on exact trigger mechanics is limited; defenders should treat any untrusted web content or embedded script that reaches the Internet Explorer scripting engine as a possible vector. Successful exploitation would run code with the privileges of the current user, not automatically as SYSTEM, but that is still enough to install further malware, steal data, or move laterally if the user has elevated rights or access to sensitive resources. Confirm all technical specifics against the vendor advisory.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Internet Explorer. Internet Explorer may still be present on Windows endpoints even when Microsoft Edge is the default browser, and it can be invoked by legacy applications, ActiveX controls, group-policy settings, or file-type associations. Inventory every Windows workstation and server that still has the Internet Explorer components installed or enabled.

• Query software inventory and configuration-management databases for the presence of Internet Explorer and the Windows versions that ship it.
• Check whether IE is set as the default browser, whether enterprise mode or compatibility views are in use, and whether any line-of-business apps launch iexplore.exe or host the Trident/MSHTML engine.
• Review endpoint management tools, SCCM/Intune inventories, and vulnerability scanners for findings tied to CVE-2020-0674; always cross-check the exact build and patch level against the Microsoft advisory.
• Telemetry signs of exploitation are not uniquely documented for this CVE. Look for unexpected iexplore.exe child processes, crashes in the scripting engine, anomalous network connections originating from the browser process, or sudden execution of unsigned binaries in the user context. Correlate with web-proxy and EDR logs for visits to suspicious sites around the time of crashes or alerts.

How to remediate

Patch first. Apply the security updates Microsoft released for this vulnerability, following the vendor instructions exactly. CISA’s required action is to apply updates per vendor instructions. After patching, verify the update is present on every affected host via your patch-management console or by checking the relevant knowledge-base article listed in the advisory.

• Prioritize internet-facing and high-privilege user workstations.
• Where Internet Explorer is no longer required, disable or remove it according to Microsoft guidance and migrate users and applications to a supported browser.
• Enforce least privilege so that even successful code execution runs with minimal rights.
• Keep endpoint detection and response (EDR) agents current and ensure they cover browser process behavior.

If you can't patch immediately

If immediate patching is impossible, reduce exposure with compensating controls until the update can be deployed.

• Segment and restrict: limit which users and subnets can reach untrusted web content; place high-risk users behind stricter web proxies or isolation technologies.
• Disable or constrain the affected component: use software restriction, AppLocker, or Windows Defender Application Control to block iexplore.exe where it is not business-critical; turn off unnecessary scripting or ActiveX where policy allows.
• Virtual patching / content filtering: deploy web-proxy or WAF rules that block known malicious patterns and uncategorized sites; enable enhanced protected mode and other browser hardening features if still supported.
• Heighten monitoring: alert on iexplore.exe spawning command interpreters, unusual network destinations, or memory-corruption crash signatures; retain browser and proxy logs for incident response.
• User guidance: remind users not to browse untrusted sites or open unsolicited links in Internet Explorer while the vulnerability remains unpatched.

If your data may have been exposed

Actively exploited browser vulnerabilities can lead to endpoint compromise and subsequent data theft. Known ransomware use of this specific CVE is not documented, but any successful remote-code-execution event should be treated as a potential breach. Isolate affected hosts, collect memory and disk evidence, reset credentials for the impacted user, and hunt for lateral movement. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information have already appeared in public dumps.