CVE-2020-17053: Internet Explorer Memory Corruption Vulnerability
CVE-2020-17053 is a remote code execution vulnerability in Internet Explorer, rated Critical by Microsoft, with a CVSS 3.0 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 3.17% probability of exploitation activity in the next 30 days, higher than 88% of all scored vulnerabilities. Microsoft released the fix on 10 November 2020 in the November 2020 Patch Tuesday, delivered through 4 security updates (KB4586785, KB4586793, KB4586786, KB4586781). It affects 18 products in 1 product family (Browser).
Key facts
- CVE ID
- CVE-2020-17053
- Severity
- High CVSS 7.5
- Microsoft severity
- Critical
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- More Likely
- Weakness
- CWE-787
- EPSS
- 3.17% (percentile 88%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2020 Patch Tuesday
- Product families
- Browser
CVSS score and vector
Microsoft scores CVE-2020-17053 at 7.5 (temporal 6.7) using CVSS 3.0. Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Proof of concept |
| Remediation level | Official fix |
| Report confidence | Confirmed |
NVD scores it 7.5 (HIGH) with CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products (18)
Browser
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Internet Explorer 11 on Windows 10 Version 1803 for 32-bit Systems | KB4586785 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1803 for x64-based Systems | KB4586785 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1803 for ARM64-based Systems | KB4586785 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1809 for 32-bit Systems | KB4586793 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1809 for x64-based Systems | KB4586793 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1809 for ARM64-based Systems | KB4586793 | Security Update | Yes | |
| Internet Explorer 11 on Windows Server 2019 | KB4586793 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1909 for 32-bit Systems | KB4586786 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1909 for x64-based Systems | KB4586786 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1909 for ARM64-based Systems | KB4586786 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems | KB4586786 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems | KB4586786 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems | KB4586786 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 2004 for 32-bit Systems | KB4586781 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 2004 for ARM64-based Systems | KB4586781 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 2004 for x64-based Systems | KB4586781 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 20H2 for ARM64-based Systems | KB4586781 | Security Update | Yes | |
| Internet Explorer 11 on Windows 10 Version 20H2 for 32-bit Systems | KB4586781 | Security Update | Yes |
Security updates (4)
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 7.5 (HIGH)
- NVD weakness
- CWE-787
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| internet explorer 11 | all listed versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17053 (Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17053 (Patch, Vendor Advisory)
Acknowledgments
- Elliot Cao (@iamelli0t) working with Trend Micro Zero Day Initiative
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |