cbcvebase.
CVE-2016-0111
published 2016-03-09

CVE-2016-0111: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption)…

PriorityP261high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
43.64%
98.6th percentile
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0112, and CVE-2016-0113.

Affected

3 ranges
VendorProductVersion rangeFixed in
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——

Detection & IOCsextracted from sources · hover to see the quote

  • →The vulnerability is triggered via MSHTML!CSVGHelpers::SetAttributeStringAndPointer, a Use-After-Free condition reachable through CElement::ie9_setAttributeNSInternal in Internet Explorer 9–11 ↗
  • →The UAF crash occurs in MSHTML!CSVGHelpers::SetAttributeStringAndPointer+0xb6, triggered through the PROPERTYDESC::HandleStringProperty and CElement::SetAttributeFromPropDesc call chain — monitor for heap corruption faults in MSHTML at this function ↗
  • →The free of the corrupted block is detected at MSHTML!MemoryProtection::HeapFree+0x46 — heap page verifier stops at AVrfpDphReportCorruptedBlock, indicating a freed object is reused before this point ↗
  • →Exploit entry point is CElement::ie9_setAttributeNSInternal — crafted SVG attribute manipulation via setAttributeNS in a web page can trigger the UAF; monitor for anomalous SVG attribute setting in IE renderer process ↗
  • ·The NVD source document describes CVE-2016-0112, not CVE-2016-0111; CVE-2016-0111 is only mentioned in passing as a related-but-distinct vulnerability. The exploit-db entry is labelled MS16-023 and references the CSVGHelpers UAF, which may overlap with multiple CVEs patched in that bulletin. ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.