CVE-2020-0878: Microsoft Edge and Internet Explorer Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>
CVE-2020-0878 is a memory corruption vulnerability in Microsoft Edge and Internet Explorer that can let an attacker run code in the context of the signed-in user. Because these browsers are common on Windows endpoints and the flaw has been tied to ransomware activity, unpatched systems raise the risk of compromise through ordinary web browsing or crafted content. Confirm exact product builds and fixed releases against the Microsoft advisory.
How it works
The weakness is classified as CWE-787 (out-of-bounds write). In this class of flaw, the browser mishandles memory so that data can be written outside the intended buffer. An attacker who can deliver specially crafted web content or other input processed by the vulnerable browser component may trigger the corruption. Successful abuse can lead to arbitrary code execution under the privileges of the current user, which on a typical desktop may still allow further actions such as installing malware, stealing tokens, or moving laterally if the user has elevated rights or access to sensitive resources. Exact trigger conditions and exploit mechanics are not detailed here; treat any public proof-of-concept claims cautiously and verify against the vendor advisory.
Am I affected? How to find it in your systems
Microsoft Edge (legacy/EdgeHTML era) and Internet Explorer are the affected products. These browsers commonly appear on Windows workstations, terminal servers, kiosks, and some application hosts that still embed or launch IE/Edge components for compatibility.
- Inventory Windows endpoints and identify installations of Internet Explorer and the legacy Microsoft Edge browser; check installed browser versions and update history against the Microsoft security advisory for CVE-2020-0878.
- Look for systems that still have IE enabled via Windows Features, Group Policy, or enterprise application compatibility settings, and for any software that hosts the Trident/MSHTML engine.
- Review software deployment and vulnerability-management tools for missing cumulative updates that address this CVE; confirm the precise fixed builds in the vendor bulletin rather than relying on generic version ranges.
- Telemetry and log signs of exploitation are often subtle for browser memory-corruption bugs: unexpected browser crashes, child processes spawned from the browser, unusual network connections shortly after browsing activity, or endpoint detection alerts for code injection or suspicious module loads. Correlate with web proxy or DNS logs for visits to untrusted sites if you suspect targeting.
How to remediate
Patch first. Apply the Microsoft updates that address CVE-2020-0878 exactly as described in the vendor advisory and follow CISA’s required action to apply updates per vendor instructions. Use your standard patch-management process to deploy the relevant cumulative or security updates to all affected Windows systems, then verify installation.
- After patching, restart browsers or systems as required by the update so the fixed components load.
- Reduce ongoing exposure by moving users off Internet Explorer and legacy Edge where possible; prefer current supported browsers with automatic updates.
- Harden remaining IE/Edge usage: enforce least privilege for users, disable unnecessary ActiveX or legacy document modes via policy, and keep the OS and related browser components fully updated.
- Re-scan with your vulnerability management tool to confirm the CVE no longer reports as open.
If you can't patch immediately
Until the vendor update can be applied, reduce risk with compensating controls focused on this browser memory-corruption class.
- Segment high-risk or unpatched endpoints from sensitive networks and limit their ability to reach critical servers.
- Use application control or browser isolation so that web content is rendered in a restricted environment rather than directly on the primary desktop.
- If a web application firewall or secure web gateway is in place, enable virtual patching or blocking rules that target known exploit patterns for this CVE only after validating them against vendor or trusted threat-intel guidance; do not rely on signatures alone.
- Disable or restrict Internet Explorer and legacy Edge where business needs allow; block execution of the vulnerable binaries via software restriction or AppLocker policies if feasible.
- Increase monitoring: alert on browser crashes, anomalous child processes, and post-browse outbound connections; ensure EDR is active and tuned for memory-corruption and ransomware behaviors, given known ransomware use of this vulnerability.
If your data may have been exposed
Actively exploited vulnerabilities, including those with known ransomware use, frequently lead to credential theft, malware deployment, or broader breaches. If you suspect compromise, isolate affected hosts, preserve forensic data, reset credentials for the impacted user context, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in public breach corpora and then prioritize password changes and multifactor authentication accordingly.
AICompiled with AI assistance from public sources and published under our editorial standards.
Details
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N