cbcvebase.
CVE-2016-0108
published 2016-03-09

CVE-2016-0108: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka…

PriorityP263high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
43.40%
98.6th percentile
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0109, and CVE-2016-0114.

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftinternet_explorer——

Detection & IOCsextracted from sources · hover to see the quote

other*:before { content:counter(counter-0) close-quote url(?); column-count:1; position:fixed; }↗
  • →Crash occurs in MSHTML!Layout::LayoutBuilderDriver::BuildPageLayout — monitor for access violations originating from this function when processing CSS content properties combined with column-count and position:fixed in IE11. ↗
  • →The exploit triggers a Read AV via a crafted CSS rule using 'content:counter() close-quote url()' combined with 'column-count' and 'position:fixed' — detect HTML/CSS payloads containing this combination targeting Internet Explorer 11. ↗
  • →Call stack shows exploitation path through MSHTML layout engine into IEFRAME tab thread — look for IE11 renderer crashes involving Layout::PageCollection::FormatPage and Layout::PageCollection::LayoutPagesCore in crash telemetry. ↗
  • ·Vulnerability is specific to Internet Explorer 11 only; other IE versions are not listed as affected by this CVE. ↗
  • ·The exploit PoC from Exploit-DB is a minimal CSS trigger; real-world weaponization may wrap this in additional obfuscation or combine with other MS16-023 vulnerabilities (CVE-2016-0102, -0103, -0106, -0109, -0114). ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.