Internet Explorer vulnerabilities

43 known vulnerabilities in Internet Explorer from Microsoft. 36 are rated high or critical, and 43 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Microsoft Internet Explorer Remote Code Execution Exploited

  CVE-2021-27085Mar 11, 2021MicrosoftEPSS 5.45%

  Internet Explorer Remote Code Execution Vulnerability

• 8.8 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2021-26411Mar 11, 2021MicrosoftEPSS 81.7%

  Internet Explorer Memory Corruption Vulnerability

• 7.5 High severity

  Microsoft Edge and Internet Explorer Memory Corruption Exploited

  CVE-2020-0878Sep 11, 2020MicrosoftEPSS 2.7%

  <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker

• 8.8 High severity

  Microsoft Internet Explorer Scripting Engine Memory Corruption Exploited

  CVE-2020-1380Aug 17, 2020MicrosoftEPSS 24.2%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current u

• 7.5 High severity

  Microsoft Internet Explorer Scripting Engine Memory Corruption Exploited

  CVE-2020-0968Apr 15, 2020MicrosoftEPSS 30.7%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970.

• 7.5 High severity

  Microsoft Internet Explorer Scripting Engine Memory Corruption Exploited

  CVE-2020-0674Feb 11, 2020MicrosoftEPSS 86.9%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CV

• 7.5 High severity

  Microsoft Internet Explorer Scripting Engine Memory Corruption Exploited

  CVE-2019-1429Nov 12, 2019MicrosoftEPSS 77.3%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.

• 7.5 High severity

  Microsoft Internet Explorer Scripting Engine Memory Corruption Exploited

  CVE-2019-1367Sep 23, 2019MicrosoftEPSS 52.4%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.

• 7.5 High severity

  Microsoft Internet Explorer Type Confusion Exploited

  CVE-2019-0752Apr 9, 2019MicrosoftEPSS 81.7%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.

• 6.5 Medium severity

  Microsoft Internet Explorer Information Disclosure Exploited

  CVE-2019-0676Mar 5, 2019MicrosoftEPSS 8.11%

  An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vul

• 8.8 High severity

  Microsoft MSHTML Remote Code Execution Exploited

  CVE-2019-0541Jan 8, 2019MicrosoftEPSS 53.2%

  A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explo

• 7.5 High severity

  Microsoft Internet Explorer Scripting Engine Memory Corruption Exploited

  CVE-2018-8653Dec 20, 2018MicrosoftEPSS 29.6%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer

• 7.5 High severity

  Microsoft Scripting Engine Memory Corruption Exploited

  CVE-2018-8373Aug 15, 2018MicrosoftEPSS 61.8%

  A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer

• 8.8 High severity

  Microsoft Internet Explorer Remote Code Execution Exploited

  CVE-2017-0222May 12, 2017MicrosoftEPSS 29.6%

  A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.

• 8.8 High severity

  Microsoft Internet Explorer Privilege Escalation Exploited

  CVE-2017-0210Apr 12, 2017MicrosoftEPSS 22.3%

  An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka "Internet Explorer Elevation of Pr

• 8.8 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2017-0149Mar 17, 2017MicrosoftEPSS 28.5%

  Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." This vulnerability is different from tho

• 4.3 Medium severity

  Microsoft Internet Explorer Information Disclosure Exploited

  CVE-2017-0059Mar 17, 2017MicrosoftEPSS 62%

  Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CV

• 8.1 High severity

  Microsoft Edge and Internet Explorer Type Confusion Exploited

  CVE-2017-0037Feb 26, 2017MicrosoftEPSS 80.4%

  Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors invo

• 6.5 Medium severity

  Microsoft Internet Explorer Messaging API Information Disclosure Exploited

  CVE-2016-3298Oct 14, 2016MicrosoftEPSS 33.3%

  Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explo

• 6.5 Medium severity

  Microsoft Internet Explorer and Edge Information Disclosure Exploited

  CVE-2016-3351Sep 14, 2016MicrosoftEPSS 26.5%

  Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

• 7.5 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2016-0189May 11, 2016MicrosoftEPSS 94.1%

  The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scr

• 4.3 Medium severity

  Microsoft Internet Explorer Information Disclosure Exploited

  CVE-2016-0162Apr 12, 2016MicrosoftEPSS 21.9%

  Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."

• 8.8 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2015-2502Aug 19, 2015MicrosoftEPSS 51%

  Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.

• 8.8 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2015-2425Jul 14, 2015MicrosoftEPSS 44.7%

  Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and

• 8.8 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2015-2419Jul 14, 2015MicrosoftEPSS 53%

  JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."

• 6.5 Medium severity

  Microsoft Internet Explorer ASLR Bypass Exploited

  CVE-2015-0071Feb 11, 2015MicrosoftEPSS 33.6%

  Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-0313Feb 2, 2015AdobeEPSS 95.3%

  Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil

• 9.8 Critical severity

  Adobe Flash Player Remote Code Execution Exploited

  CVE-2015-0311Jan 23, 2015AdobeEPSS 85.6%

  Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild

• 8.8 High severity

  Microsoft Internet Explorer Privilege Escalation Exploited

  CVE-2014-4123Oct 15, 2014MicrosoftEPSS 47.1%

  Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploited in the wild in October 2014, a different vulnerability than CVE-2014-4124.

• 8.8 High severity

  Microsoft Internet Explorer Privilege Escalation Exploited

  CVE-2014-2817Aug 12, 2014MicrosoftEPSS 26.3%

  Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

• 10.0 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2014-1776Apr 27, 2014MicrosoftEPSS 82.7%

  Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in

• 4.3 Medium severity

  Microsoft Internet Explorer Information Disclosure Exploited

  CVE-2013-7331Feb 26, 2014MicrosoftEPSS 50.2%

  The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a r

• 8.8 High severity

  Microsoft Internet Explorer Use-After-Free Exploited

  CVE-2014-0322Feb 14, 2014MicrosoftEPSS 85.1%

  Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in J

• 8.8 High severity

  Microsoft Internet Explorer Use-After-Free Exploited

  CVE-2013-3897Oct 9, 2013MicrosoftEPSS 77.3%

  Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onp

• 9.3 High severity

  Microsoft Internet Explorer Resource Management Errors Exploited

  CVE-2013-3893Sep 18, 2013MicrosoftEPSS 87.6%

  Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that trigge

• 8.8 High severity

  Microsoft Internet Explorer Memory Corruption Exploited

  CVE-2013-3163Jul 10, 2013MicrosoftEPSS 70.7%

  Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013

• 8.8 High severity

  Microsoft Internet Explorer Remote Code Execution Exploited

  CVE-2013-1347May 5, 2013MicrosoftEPSS 77.7%

  Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.

• 8.8 High severity

  Microsoft Internet Explorer Use-After-Free Exploited

  CVE-2013-2551Mar 11, 2013MicrosoftEPSS 74.1%

  Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013

• 8.8 High severity

  Microsoft Internet Explorer Use-After-Free Exploited

  CVE-2012-4792Dec 30, 2012MicrosoftEPSS 78.8%

  Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnB

• 8.1 High severity

  Microsoft Internet Explorer Use-After-Free Exploited

  CVE-2012-4969Sep 18, 2012MicrosoftEPSS 80.3%

  Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.