⚠ Actively exploited
Added to CISA KEV on 2022-03-28. Federal agencies required to patch by 2022-04-18. Required action: Apply updates per vendor instructions..
Severity
8.8HIGHNVD
NVD8.1NVD7.5NVD4.3CNA8.1CNA7.5VulnCheck8.1CISA8.1
EPSS
90.5%
top 0.39%
CISA KEV
KEV
Added 2022-03-28
Due 2022-04-18
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedFeb 26
KEV addedMar 28
KEV dueApr 18
Latest updateMay 17
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

CVEListV5microsoft_corporation/internet_explorerInternet Explorer 10 and 11, Internet Explorer 9 through 11, The VBScript engine in Microsoft Internet Explorer 11+2
CVEListV5microsoft_corporation/internet_browserInternet Explorer 10 and 11 and Edge

Patches

🔴Vulnerability Details

9
GHSA
GHSA-8xx2-2w6g-2ff2: Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted2022-05-17
GHSA
GHSA-xpg5-jv85-754h: Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSp2022-05-17
GHSA
GHSA-vrcm-c43w-vj64: The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web si2022-05-17
GHSA
GHSA-xqqj-2hmg-wc6r: Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft2022-05-17
CVEList
CVE-2017-0018: Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted2017-03-17

💥Exploits & PoCs

3
Exploit-DB
Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007)2017-10-17
Exploit-DB
Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007)2017-07-24
Exploit-DB
Microsoft Edge / Internet Explorer - 'HandleColumnBreakOnColumnSpanningElement' Type Confusion2017-02-24

📋Vendor Advisories

2
CISA
Microsoft Edge and Internet Explorer Type Confusion Vulnerability2022-03-28
Microsoft
Microsoft Browser Memory Corruption Vulnerability2017-03-14

🕵️Threat Intelligence

8
Zscaler
Top Exploit Kit Activity Roundup - Summer 2017 | Zscaler2017-09-12
Krebs
Adobe, Microsoft Push Critical Security Fixes2017-03-14
Qualys
Massive Microsoft Patch Tuesday Security Update for March2017-03-14
Qualys
Massive Microsoft Patch Tuesday Security Update for March | Qualys2017-03-14
Talos
Microsoft Patch Tuesday - March 20172017-03-14
CVE-2017-0037 — Type Confusion | cvebase