{"id":"CVE-2016-0189","kind":"vulnerability","aliases":["CVE-2016-0189"],"related":[],"title":"Microsoft Internet Explorer: Microsoft Internet Explorer Memory Corruption Vulnerability","description":"The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"Scripting Engine Memory Corruption Vulnerability,\" a different vulnerability than CVE-2016-0187.","summary":"Memory corruption in the JScript and VBScript engines used by Internet Explorer lets a crafted web page run code or crash the browser. CISA lists it as actively exploited and tagged with ransomware use.","severity":"high","cvss":7.6,"epss":0.94062,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Microsoft Internet Explorer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","internet-explorer","other","ransomware","windows"],"not_affected_if":["fully-patched-windows","no-internet-explorer-installed"],"how_to_check":"Check whether Internet Explorer is still installed and in use on Windows machines, for example with the Windows optional features list or by running iexplore.exe.","fix":"Apply the Microsoft security update for this CVE per vendor instructions, or remove or stop using Internet Explorer.","status":"open","published_at":"2016-05-11T01:59:30+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:52+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T21:19:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for this CVE per vendor instructions, or remove or stop using Internet Explorer.\nunknown","reach":"internet","impact":"high","summary":"Memory corruption in the JScript and VBScript engines used by Internet Explorer lets a crafted web page run code or crash the browser. CISA lists it as actively exploited and tagged with ransomware use.","category":"other","who_cares":["windows","internet-explorer"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the victim's machine via a crafted website.","analyst_note":"Confirm the affected Windows and IE versions and the exact Microsoft bulletin (MS16-023 per public references) from the NVD or Microsoft Security Response Center entry for CVE-2016-0189.","how_to_check":"Check whether Internet Explorer is still installed and in use on Windows machines, for example with the Windows optional features list or by running iexplore.exe.\nunknown","needs_analyst":true,"not_affected_if":["no-internet-explorer-installed","fully-patched-windows"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2860,"output_tokens":418,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0187':115C '-0189':12A,15A '-2016':11A,14A,114C '1':62C '11':79C '2':66C '5.7':68C '5.8':64C,70C '9':77C 'activ':53B 'aka':103C 'allow':83C 'arbitrari':88C 'attack':85C 'browser':48B 'caus':91C 'cisa':49B 'code':44B,89C 'corrupt':8A,27B,97C,107C 'craft':40B,100C 'crash':46B 'cve':10A,13A,113C 'denial':93C 'differ':110C 'engin':33B,71C,105C 'execut':87C 'exploit':19B,54B 'explor':3A,6A,22B,37B,76C 'explorer':18A 'internet':2A,5A,17A,21B,36B,75C 'internet-explor':20B 'jscript':30B,63C 'let':38B 'list':50B 'memori':7A,26B,96C,106C 'microsoft':1A,4A,16A,61C 'page':42B 'product':82C 'ransomwar':24B,58B 'remot':84C 'run':43B 'script':104C 'servic':95C 'site':102C 'tag':56B 'use':34B,59B,73C 'vbscript':32B,67C 'via':98C 'vulner':9A,108C,111C 'web':41B,101C 'window':25B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-05-11T01:59:30+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-0189","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0189","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2016-0189","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0189","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-0189","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0189","severity":null,"published_at":"2016-05-11T01:59:30+00:00","modified_at":"2026-06-17T00:37:05+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}