May 2020: MSHTML Engine Remote Code Execution Vulnerability
CVE-2020-1064 Published on May 21, 2020

MSHTML Engine Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a HTML editing attack scenario, an attacker could trick a user into editing a specially crafted file that is designed to exploit the vulnerability. The security update addresses the vulnerability by modifying how MSHTML engine validates input.

Vendor Advisory NVD


Products Associated with CVE-2020-1064

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft Internet Explorer (IE)
 
Microsoft Windows 10
 
Microsoft Windows Server 2012
 

Affected Versions

Microsoft Internet Explorer 11: Microsoft Internet Explorer 9:

Exploit Probability

EPSS
3.14%
Percentile
86.88%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.