CVEvulnerability

CVE-2019-0541

8.8 HIGH Known exploited Published 2019-01-08 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Microsoft MSHTML Remote Code Execution Vulnerability — Microsoft MSHTML

Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2019-0541
Status
Analyzed
Published
2019-01-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-77

Description

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.

Affected configurations

• microsoft internet explorer 11 • microsoft excel viewer 2007 • microsoft office 2010 • microsoft office 2013 • microsoft office 2016 • microsoft office 2019 • microsoft office 365 proplus • microsoft office word viewer • microsoft internet explorer 9 • microsoft internet explorer 10

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References