CVE-2016-0189VulnerabilityPublished 03/28/2022Updated 10/24/2026

CVE-2016-0189: Microsoft Internet Explorer Memory Corruption Vulnerability

Affects Microsoft Internet ExplorerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/28/2022
KEV deadline: 04/18/2022
Ransomware: Used in ransomware campaigns
EPSS: 94.1% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-0189 (opens in a new tab)

Description

CVE-2016-0189 is a memory corruption vulnerability in the Microsoft JScript and VBScript engines used by Internet Explorer and other Microsoft products. This flaw allows attackers to execute remote code or cause a denial of service by crafting malicious web content. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the input data.

Summary

The vulnerability CVE-2016-0189 affects the Microsoft JScript and VBScript engines embedded in Internet Explorer and other Microsoft products. It enables remote attackers to execute arbitrary code or trigger a denial of service condition through memory corruption by delivering specially crafted web content. This vulnerability has been actively exploited in the wild, including use in ransomware campaigns. The input data does not specify affected versions or patch availability.

Impact

Successful exploitation can lead to remote code execution or denial of service on affected systems running vulnerable versions of Internet Explorer or other Microsoft products using the JScript and VBScript engines. This can result in system compromise or disruption of service. The vulnerability has been observed in active exploitation scenarios, increasing its risk.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided in the input data, users should consult Microsoft security advisories to determine if updates or mitigations are available. Until then, minimizing exposure to untrusted web content and disabling scripting engines where feasible may reduce risk.

Weaknesses

CWE-119Buffer Errors (Memory Bounds) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:11:50 UTC

Weaknesses

References

Related threats