8.8
High
CVE-2019-0541 Microsoft MSHTML Remote Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-77
Description
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Office | Versions not published | |
| Microsoft Office Word Viewer | Versions not published | |
| Internet Explorer 9 | Versions not published | |
| Internet Explorer 11 | Versions not published | |
| Microsoft Excel Viewer | Versions not published | |
| Internet Explorer 10 | Versions not published | |
| Office | Versions not published |
Other CVEs of Microsoft Office
The 126 CVEs of Microsoft Office →
CVE-2020-1449
A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source…
Not rated
CVE-2020-1447
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in…
Not rated
CVE-2020-1448
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in…
Not rated
CVE-2020-1445
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory,…
Not rated