---
id: "CVE-2019-0541"
kind: "vulnerability"
aliases: ["CVE-2019-0541"]
title: "Microsoft MSHTML: Microsoft MSHTML Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.53202
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft MSHTML", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "internet-explorer", "microsoft-office", "windows"]
not_affected_if: ["patched-windows"]
published_at: "2019-01-08T21:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0541", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-0541", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0541", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft MSHTML: Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft's MSHTML browser engine has an input validation flaw that lets remote code run. An attacker who gets a user to load crafted content can run code as that user, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft MSHTML affected ? fixed ?

## Fix

Apply the Microsoft security update for CVE-2019-0541 per vendor instructions, as CISA requires.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0541
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-0541
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-0541

## From the sources

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_