CVE-2020-0674

CVE-2020-0674 is a use-after-free memory corruption flaw (CWE-416) in the way the Internet Explorer scripting engine handles objects in memory, distinct from a series of sibling scripting-engine RCEs fixed at the same time (CVE-2020-0673, 0710, 0711, 0712, 0713, 0767). Triggering it requires user interaction: an attacker must convince a user to view a specially crafted web page (for example via a phishing link or malicious web content) while it renders in Internet Explorer, and the mishandled memory then allows code execution under the high-complexity, network-reachable conditions reflected in the CVSS vector (AV:N/AC:H/UI:R). Successful exploitation gives the attacker remote code execution with the privileges of the logged-in user, so the practical risk is highest for users browsing with Internet Explorer on Windows, including IE 8 through IE 11 targeted by the public exploits. Exploitation is confirmed in the wild: Microsoft warned of the flaw as an unpatched zero-day being used in targeted attacks before its February 2020 Patch Tuesday fix, public PoC/exploit code is available (including a working exploit for IE 8-11), the Magnitude exploit kit referenced in coverage used it as a delivery vector, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 alongside a very high EPSS score (86.9% probability of exploitation in 30 days, 100th percentile). The required remediation is to apply the Microsoft security updates from February 2020 that address this CVE.

What to do: Apply the Microsoft February 2020 Patch Tuesday security updates that fix CVE-2020-0674 on all Windows endpoints and servers, prioritizing per the CISA KEV required action. Until patched, limit Internet Explorer use to trusted sites and consider Microsoft's suggested mitigations (such as restricting active scripting); note that third-party micropatches existed that emulated the vendor workaround without its usability side effects. After patching, verify IE11 remediation status across the estate and, where feasible, retire Internet Explorer usage entirely to reduce exposure to this recurring scripting-engine bug class.