{"id":"CVE-2020-1380","kind":"vulnerability","aliases":["CVE-2020-1380"],"related":[],"title":"Microsoft Internet Explorer: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","description":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\nIn a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.\nThe security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.","summary":"Internet Explorer's scripting engine has a memory corruption bug that lets a web page run code as the current user. It is listed in CISA's Known Exploited Vulnerabilities catalog, meaning attacks have been seen in the wild.","severity":"high","cvss":8.8,"epss":0.24188,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Internet Explorer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","internet-explorer","runtime","windows"],"not_affected_if":["no-ie-installed"],"how_to_check":"Check whether Internet Explorer is installed and still in use, for example via the Windows optional features list or by running iexplore.exe.","fix":"Apply the Microsoft security updates for the affected Internet Explorer versions per vendor instructions; remove or disable Internet Explorer where it is no longer needed.","status":"open","published_at":"2020-08-17T19:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:13+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:37:13Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security updates for the affected Internet Explorer versions per vendor instructions; remove or disable Internet Explorer where it is no longer needed.\nunknown","reach":"internet","impact":"high","summary":"Internet Explorer's scripting engine has a memory corruption bug that lets a web page run code as the current user. It is listed in CISA's Known Exploited Vulnerabilities catalog, meaning attacks have been seen in the wild.","category":"runtime","who_cares":["windows","internet-explorer"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the logged-in user after the victim visits a page","analyst_note":"Confirm affected and fixed Windows/IE build numbers and the patch KB from the Microsoft advisory for CVE-2020-1380; sources did not list them.","how_to_check":"Check whether Internet Explorer is installed and still in use, for example via the Windows optional features list or by running iexplore.exe.\nunknown","needs_analyst":true,"not_affected_if":["no-ie-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00049,"input_tokens":2839,"output_tokens":412,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1380':14A,17A '-2020':13A,16A 'accept':241C 'account':165C 'activex':210C 'address':265C 'administr':134C 'advantag':234C 'advertis':249C 'affect':149C 'also':207C,232C 'applic':218C 'arbitrari':100C 'attack':59B,97C,110C,138C,152C,175C,178C,205C,230C 'base':174C 'bug':36B 'catalog':57B 'chang':158C 'cisa':52B 'code':43B,68C,101C 'compromis':236C 'contain':253C 'content':247C,256C 'context':104C 'control':146C,211C 'convinc':197C 'corrupt':10A,35B,89C 'could':88C,98C,116C,144C,153C,179C,206C,231C,252C,258C 'craft':183C,255C 'creat':163C 'current':46B,107C,124C,128C 'cve':12A,15A 'data':161C 'delet':160C 'design':187C 'document':222C 'emb':208C 'engin':8A,31B,78C,228C,273C 'execut':69C,99C 'exist':71C 'exploit':21B,55B,113C,141C,189C,259C 'explor':3A,6A,24B,28B,85C,194C 'explorer':20A 'full':167C 'gain':117C 'handl':79C,274C 'host':180C,224C,243C 'ie':226C 'initi':215C 'instal':155C 'internet':2A,5A,19A,23B,27B,84C,193C 'internet-explor':22B 'known':54B 'let':38B 'list':50B 'log':131C 'mark':212C 'mean':58B 'memori':9A,34B,82C,90C,277C 'microsoft':1A,4A,18A,220C 'modifi':269C 'new':164C 'object':80C,275C 'offic':221C 'page':41B 'program':156C 'provid':246C 'remot':67C 'render':227C 'right':121C,136C,169C 'run':42B 'runtim':25B 'safe':213C 'scenario':176C 'script':7A,30B,77C,272C 'secur':263C 'seen':62B 'special':182C,254C 'success':112C,140C 'system':150C 'take':145C,233C 'updat':264C 'user':47B,108C,120C,125C,129C,135C,168C,199C,245C 'user-provid':244C 'view':157C,201C 'vulner':11A,56B,70C,87C,115C,143C,191C,261C,267C 'way':74C,94C 'web':40B,173C 'web-bas':172C 'websit':184C,203C,237C,239C,251C 'wild':65B 'window':26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-08-17T19:15:14+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-1380","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1380","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:44+00:00","note":null},{"source":"epss","external_id":"CVE-2020-1380","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-1380","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-1380","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1380","severity":null,"published_at":"2020-08-17T19:15:14+00:00","modified_at":"2026-06-17T03:01:15+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}