Scripting Engine Memory Corruption Vulnerability (CVE-2020-1380)

What is affected, what to do

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Internet Explorer 11 gte 1.0.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Verify and deploy the patch: Microsoft fixed this in the August 2020 cumulative security update for Internet Explorer 11 / Windows. Look up the exact KB per Windows build in the Microsoft Security Update Guide entry for CVE-2020-1380. Use WSUS, Intune, SCCM or Get-HotFix to confirm every client and server is at that level or later. Remediate stragglers immediately.
   • Find unsupported systems: Windows 7, Server 2008 R2 and older builds without ESU no longer receive fixes. Cut these off from internet browsing or move them to a quarantine VLAN until they are decommissioned.
   • Disable standalone IE 11: Apply the GPO "Disable Internet Explorer 11 as a standalone browser" or remove the optional feature (Disable-WindowsOptionalFeature -Online -FeatureName Internet-Explorer-Optional-amd64). Enforce Edge as the default browser.
   • Restrict Edge IE mode: Limit the Enterprise Site List to essential internal applications only. Never route external domains through IE mode, because it uses the same Trident/MSHTML engine.
   • Block ActiveX in Office documents: Set "Disable All ActiveX" via GPO under Office Trust Center → ActiveX Settings. This closes the document-borne vector that hosts the IE rendering engine.
   • Start threat hunting: Review process trees from the last 30 days on exposed endpoints, especially late-patched ones, using the detections below.
2. 02

   Runbook step 2

   Mitigation layers

   • Network / proxy: At the web proxy, block or isolate (remote browser isolation) requests with a Trident/7.0 or MSIE user-agent to external, non-approved destinations. Grant internal exceptions via allowlist only.

   • Mail and content filtering: Quarantine Office documents containing embedded ActiveX or OLE objects that reference htmlfile or Shell.Explorer. Rewrite or sandbox links to newly registered or uncategorised domains.

   • Endpoint hardening: Enable these Defender ASR rules:

     • "Block Office applications from creating child processes" (D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
     • "Block Office applications from creating executable content" (3B576869-A4EC-4529-8536-B80A7769E899)

     Also enforce Exploit Protection (CFG, DEP, mandatory ASLR) for iexplore.exe.

   • Least privilege: Remove local admin rights from standard users, since code runs in the logged-on user's context. Perform admin work from separate accounts or PAWs that are not used for browsing.

   • Configuration: Where IE 11 cannot yet be removed, enforce Enhanced Protected Mode and Protected Mode in all zones. Disable Active Scripting in the Internet zone.

3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / Windows 4688 – suspicious ancestry: iexplore.exe spawning cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe or wscript.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "iexplore.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","regsvr32.exe","mshta.exe")
   • Sysmon EID 7 – engine loaded by Office: jscript9.dll or mshtml.dll loaded by winword.exe, excel.exe or powerpnt.exe, which indicates a document hosting the IE engine. Sigma shape: ImageLoaded|endswith: '\jscript9.dll' AND Image|endswith: ['\winword.exe','\excel.exe'].
   • Sysmon EID 11 – browser file drops: iexplore.exe writing .exe, .dll or .ps1 files to %TEMP%, %APPDATA% or \ProgramData\, followed by execution of that file.
   • Proxy / Zeek logs: Outbound HTTP(S) with Trident/7.0 in the user-agent to external domains, particularly when followed by a binary download. SPL: index=proxy useragent="*Trident/7.0*" NOT dest_domain IN (allowlist) | stats count by src_ip, dest_domain
   • Exploit-mitigation telemetry: Monitor Microsoft-Windows-Security-Mitigations/UserMode and Defender exploit-block events for iexplore.exe. Investigate clusters of Application Event ID 1000 crashes with faulting module jscript9.dll.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.

Source: CSA/SingCERT, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Internet Explorer
• Microsoft Internet Explorer 11

Weakness classes (CWE)

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2020-1380x_refsource_MISC, Patch, Vendor advisory
• packetstormsecurity.comfiles/163056/Internet-Explorer-jscript9.dll-Memory-Corruption.h…x_refsource_MISC, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1380government-resource, US government resource