{"id":"CVE-2019-0541","kind":"vulnerability","aliases":["CVE-2019-0541"],"related":[],"title":"Microsoft MSHTML: Microsoft MSHTML Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka \"MSHTML Engine Remote Code Execution Vulnerability.\" This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.","summary":"Microsoft's MSHTML browser engine has an input validation flaw that lets remote code run. An attacker who gets a user to load crafted content can run code as that user, and CISA lists it as actively exploited.","severity":"critical","cvss":9.3,"epss":0.53202,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft MSHTML","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","internet-explorer","microsoft-office","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2019-0541 per vendor instructions, as CISA requires.","status":"open","published_at":"2019-01-08T21:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:21+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:37:21Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2019-0541 per vendor instructions, as CISA requires.\nunknown","reach":"internet","impact":"high","summary":"Microsoft's MSHTML browser engine has an input validation flaw that lets remote code run. An attacker who gets a user to load crafted content can run code as that user, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["windows","microsoft-office","internet-explorer"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the logged-in user after victim opens crafted content","analyst_note":"Find the exact affected Windows builds and KB article numbers at the Microsoft Security Update Guide entry for CVE-2019-0541 and confirm a detection method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000459,"input_tokens":2824,"output_tokens":353,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the exact affected Windows builds and KB article numbers at the Microsoft Security Update Guide entry for CVE-2019-0541 and confirm a detection method.","search":"'-0541':11A,14A '-2019':10A,13A '10':106C '11':100C '365':108C '9':97C 'activ':62B 'affect':88C 'aka':80C 'attack':42B 'browser':29B 'cisa':58B 'code':6A,39B,53B,66C,84C 'content':50B 'craft':49B 'cve':9A,12A 'engin':30B,76C,82C 'excel':102C 'execut':7A,67C,85C 'exist':69C 'exploit':17B,63B 'explor':21B,96C,99C,105C 'flaw':35B 'get':44B 'infrastructur':18B 'inprop':77C 'input':33B,79C 'internet':20B,95C,98C,104C 'internet-explor':19B 'let':37B 'list':59B 'load':48B 'microsoft':1A,3A,15A,23B,26B,89C,91C,101C 'microsoft-offic':22B 'mshtml':2A,4A,16A,28B,75C,81C 'offic':24B,90C,92C,107C 'proplus':109C 'remot':5A,38B,65C,83C 'run':40B,52B 'user':46B,56B 'valid':34B,78C 'viewer':94C,103C 'vulner':8A,68C,86C 'way':72C 'window':25B 'word':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-01-08T21:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-0541","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0541","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-0541","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0541","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-0541","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0541","severity":null,"published_at":"2019-01-08T21:29:00+00:00","modified_at":"2026-06-17T02:08:19+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}