high8.8Known exploitedPublic exploit code
CVE-2019-0541
Microsoft MSHTML Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Windows MSHTML Engine - 'Edit' Remote Code Execution2019-03-13 · local · windows
Impact
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Internet Explorer | Versions 11, 9, 10 |
| Microsoft | Excel Viewer | Version 2007 |
| Microsoft | Office | Versions 2010, 2013, 2016, 2019 |
| Microsoft | Office 365 Proplus | All versions |
| Microsoft | Office Word Viewer | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://www.securityfocus.com/bid/106402
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541
- https://www.exploit-db.com/exploits/46536/
- http://www.securityfocus.com/bid/106402
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541
- https://www.exploit-db.com/exploits/46536/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0541