Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2016-0189)

What is affected, what to do

The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft JScript eq 5.8..5.8
• Microsoft VBScript eq 5.7..5.7
• Microsoft VBScript eq 5.8..5.8
• Microsoft Internet Explorer 11 eq 9..9
• Microsoft Internet Explorer 11 eq 10..10
• Microsoft Internet Explorer 11 eq 11..11

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Verify and apply security updates: Microsoft fixed this in May 2016 via bulletins MS16-051 (IE cumulative) and MS16-053 (JScript/VBScript). Look up the exact KB per OS in the vendor advisory. Any later cumulative update also covers it. Focus on hosts that have missed cumulative updates since 2016.
   • Find the stragglers: Use SCCM/Intune or EDR inventory to locate outdated jscript.dll/vbscript.dll builds and unsupported Windows versions. Common examples are Windows 7, Server 2008/R2, and embedded, HMI and kiosk images in OT. Cut internet access for anything that cannot be patched.
   • Retire Internet Explorer: Where IE 9–11 still runs as a desktop app, block it via GPO ("Disable Internet Explorer 11 as a standalone browser"). Restrict Edge IE mode to explicitly listed internal sites via the Enterprise Mode Site List.
   • Disable VBScript in IE: Use GPO or registry. Under HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3, set 140C = 3 to disable VBScript in the Internet zone. Consider applying the same setting to zones 1 and 2.
   • Kick off a compromise assessment: On unpatched, internet-facing hosts, hunt back through EDR telemetry for suspicious iexplore.exe child processes (see Detection rules). Given the ransomware flag, isolate any hit immediately and rotate credentials.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move legacy systems that still need IE or the scripting engines (HMIs, line-of-business apps) into dedicated VLANs with no direct internet access. Allow egress only through an authenticating proxy with an allowlist.
   • Web proxy / SWG: Block MSIE/Trident/ user agents to non-approved destinations. Deny the newly registered, uncategorised and malvertising categories, since the typical delivery path is exploit-kit drive-by.
   • IPS signatures: Enable vendor signatures for CVE-2016-0189 / "Scripting Engine Memory Corruption" in your Suricata/Snort ruleset (ET/Talos). Run exploit-kit landing-page rules in blocking mode.
   • Endpoint hardening: As a stopgap, apply Microsoft's workaround of restricting access to the engine DLLs. Run takeown /f %windir%\system32\vbscript.dll, then cacls %windir%\system32\vbscript.dll /E /P everyone:N, and repeat for jscript.dll and SysWOW64. Test against business apps first. Add ASR rules and WDAC/AppLocker to block mshta.exe, wscript.exe and cscript.exe for standard users.
   • Least privilege: Allow browsing only without local admin rights. Enforce Enhanced Protected Mode wherever IE cannot be removed.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / EDR): Alert when ParentImage ends with \iexplore.exe and the child is cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe or mshta.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "iexplore.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","regsvr32.exe","wscript.exe","mshta.exe")
   • File creation (Sysmon EID 11): Watch for iexplore.exe writing .exe, .dll or .scr files to %TEMP%, %APPDATA% or INetCache\Low, followed by execution. This is the classic exploit-kit payload drop.
   • Network/proxy (Zeek http.log, proxy logs): Look for an IE user agent (Trident/7.0) following a chain of compromised-site referrer, redirect, then a very young domain. Binary downloads with mismatched MIME types or encrypted bodies follow.
   • Crash telemetry (Windows Event ID 1000, Application): Clusters of iexplore.exe crashes with faulting module vbscript.dll or jscript.dll point to failed exploitation attempts.
   • Module loads (Sysmon EID 7): Flag vbscript.dll loading on hosts where policy should have disabled VBScript. This indicates configuration drift or an evasion attempt.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Internet Explorer
• Microsoft Microsoft JScript
• Microsoft Microsoft VBScript

Weakness classes (CWE)

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• securityfocus.com90012Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• virusbulletin.comvirusbulletin/2017/01/journey-and-evolution-god-mode-2016-cve-2…x_refsource_MISC, Exploit, Third-party advisory
• docs.microsoft.comMS16-051Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• docs.microsoft.comMS16-053Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• exploit-db.com40118Exploit, x_refsource_EXPLOIT-DB, Third-party advisory, Vulnerability database
• securitytracker.com1035820Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0189government-resource, US government resource