7.5 High Exploited

CVE-2020-0674 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-416

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.

Affected products and versions

Product	Affected versions	Fixed in
Internet Explorer 10	Versions not published
Internet Explorer 11	Versions not published
Internet Explorer 11 on Windows 10 Version 1909 for 32-bit Systems	Versions not published
Internet Explorer 11 on Windows 10 Version 1909 for x64-based Systems	Versions not published
Internet Explorer 11 on Windows 10 Version 1909 for ARM64-based Systems	Versions not published
Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems	Versions not published
Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems	Versions not published
Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems	Versions not published
Internet Explorer 11 on Windows Server 2012	Versions not published

Show the other branch

Product	Affected versions	Fixed in
Internet Explorer 9	Versions not published

References

portal.msrc.microsoft.com portal.msrc.microsoft.com
github.com github.com
packetstormsecurity.com packetstormsecurity.com
packetstormsecurity.com packetstormsecurity.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published February 11, 2020
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 86 CVEs of Internet Explorer 10 →

CVE-2020-0706 An information disclosure vulnerability exists in the way that affected Microsoft browsers handle cross-origin requests,… Not rated CVE-2020-0673 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in… Not rated CVE-2020-0640 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet… Not rated CVE-2019-1485 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka… Not rated

Track this CVE