CVE-2019-0541
HIGH severity · CVSS 8.8 · Command injection · actively exploited (CISA KEV)
8.8CVSS HIGH ● exploited
🔴 Actively exploited in the wild (CISA Known Exploited Vulnerabilities).
Added to KEV 2021-11-03. US federal agencies must patch by 2022-05-03.
Summary
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)87%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products we track (2)
Recommendation
This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.
Official patch: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541 ↗
Additional information
- NVD record
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541Patch
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541Patch
- http://www.securityfocus.com/bid/106402Advisory
- http://www.securityfocus.com/bid/106402Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0541
- https://www.exploit-db.com/exploits/46536/Advisory
- https://www.exploit-db.com/exploits/46536/Advisory