{"id":"CVE-2026-85897","kind":"vulnerability","aliases":["CVE-2026-85897"],"related":[],"title":"Microsoft Edge: heap buffer overflow lets a remote attacker run code","description":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft Edge (Chromium-based) can be triggered by an unauthorized attacker over the network. The sources say this allows code execution.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Edge (Chromium-based)","fixed":["154.0.4258.37"],"affected":"< 154.0.4258.37","ecosystem":"vendor"}],"ecosystems":[],"tags":["browser","chromium","microsoft-edge","other","windows"],"not_affected_if":["patched-154.0.4258.37"],"how_to_check":"Open edge://settings/help; if the version is below 154.0.4258.37 you are exposed. Fleet: compare installed msedge.exe file version against 154.0.4258.37.","fix":"Update Microsoft Edge to 154.0.4258.37 or later (current stable 155.0.4283.62 per HKCERT/GovCERT.HK also covers it); edge://settings/help applies the update","status":"open","published_at":"2026-10-29T16:19:45+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:27:57+00:00","updated_at":"2026-10-29T16:35:44+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-29T16:27:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Edge: heap buffer overflow lets a remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Edge (Chromium-based) can be triggered by an unauthorized attacker over the network. The sources say this allows code execution.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-edge","windows","chromium"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the user's machine over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-85897 to get affected and fixed Edge versions and whether user interaction is required.","how_to_check":"- Check the installed Edge version (edge://settings/help) against the fixed version in the vendor advisory, which the sources do not state\n- unknown","plain_action":"Update Microsoft Edge to the latest version as soon as the update is offered.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone running an affected Chromium-based Microsoft Edge build is exposed to a network-reachable attacker. The sources do not say which versions are affected or whether any non-default setting is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4080,"output_tokens":479,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-85897 to get affected and fixed Edge versions and whether user interaction is required.","search":"'-2026':13A,16A '-85897':14A,17A 'allow':56B,70C 'attack':9A,48B,73C 'base':33B,41B,61C,69C 'based':22A 'browser':23B 'buffer':4A,34B,62C 'chromium':21A,24B,40B,68C 'chromium-bas':39B,67C 'chromium-based':20A 'code':11A,57B,76C 'cve':12A,15A 'edg':2A,27B,38B,66C 'edge':19A 'execut':58B,75C 'heap':3A,32B,60C 'heap-bas':31B,59C 'let':6A 'microsoft':1A,18A,26B,37B,65C 'microsoft-edg':25B 'network':51B,79C 'overflow':5A,35B,63C 'remot':8A 'run':10A 'say':54B 'sourc':53B 'trigger':44B 'unauthor':47B,72C 'window':29B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Microsoft Edge (Chromium-based) older than 154.0.4258.37, on desktop. An attacker needs a user to open a specially crafted web page or file, so people who browse or open untrusted content are the main risk. Machines already on Edge 154.0.4258.37 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:35:44Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897","run_id":1067},"products":{"at":"2026-10-29T16:35:44Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897","run_id":1067},"how_to_check":{"at":"2026-10-29T16:35:44Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897","run_id":1067},"who_affected":{"at":"2026-10-29T16:35:44Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897","run_id":1067}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Microsoft Edge to the latest version: menu (...) > Help and feedback > About Microsoft Edge, then restart the browser.","first_public_at":"2026-10-29T16:19:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85897","severity":null,"published_at":"2026-10-29T16:19:45+00:00","modified_at":"2026-10-29T16:19:45+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-85897:1067","url":null,"severity":null,"published_at":"2026-10-29T16:35:44+00:00","modified_at":"2026-10-29T16:35:44+00:00","first_seen_at":"2026-10-29T16:35:44+00:00","fetched_at":"2026-10-29T16:35:44+00:00","note":"MSRC page read: heap overflow (CWE-122) in Edge, fixed in 154.0.4258.37 (Oct 16 2026), UI required (open crafted file/page), not exploited, not public, 'Exploitation Less Likely'. Later Edge 155.0.4283.62 also contains it."}],"documents":[{"id":17786,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897","title":"MSRC: CVE-2026-85897 Microsoft Edge (Chromium-based) RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}