CVE-2021-26411: Internet Explorer Memory Corruption Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Actively Exploited
Exploitation Likelihood
Detected
Publicly Disclosed
Yes
Patch Tuesday
2021-Mar
Released
2021-03-09
EPSS Score
92.47% (percentile: 99.7%)
CISA KEV
Listed — due 2021-11-17

FAQ

How could an attacker exploit the vulnerability? An attacker could host a specially crafted website designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.

Detection & Weaponization (1 sources)

Maturity: Exploit

  • GitHub PoC: 1 repositories

Affected Products (56)

ESU

  • Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2
  • Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2

Browser

  • Internet Explorer 11 on Windows 10 Version 1803 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1803 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1809 for ARM64-based Systems
  • Internet Explorer 11 on Windows Server 2019
  • Internet Explorer 11 on Windows 10 Version 1909 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1909 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 Version 2004 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 20H2 for ARM64-based Systems
  • Internet Explorer 11 on Windows 10 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 for x64-based Systems
  • Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems
  • Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems
  • Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1
  • Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1
  • Internet Explorer 11 on Windows 8.1 for 32-bit systems
  • Internet Explorer 11 on Windows 8.1 for x64-based systems
  • Internet Explorer 11 on Windows RT 8.1
  • Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Internet Explorer 11 on Windows Server 2012
  • Internet Explorer 11 on Windows Server 2012 R2
  • Internet Explorer 11 on Windows Server 2016
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for ARM64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows Server 2019
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for ARM64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for ARM64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for ARM64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 20H2 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 20H2 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 20H2 for ARM64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems
  • ... and 4 more

Security Updates (11)

Acknowledgments

yangkang(@dnpushme) & huangyi(@C0rk1_H), <a href="https://enki.co.kr">Enki</a>

Revision History

  • 2021-03-09: Information published.