CVE-2020-0968: Internet Explorer RCE Vulnerability

CVE-2020-0968 Overview

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This memory corruption flaw, classified under CWE-787 (Out-of-Bounds Write), could allow an attacker to execute arbitrary code in the context of the current user. If the current user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Critical Impact

This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate attention for organizations running Internet Explorer on affected Windows systems.

Affected Products

• Microsoft Internet Explorer 9 and 11
• Microsoft Windows 7 SP1, Windows 8.1, Windows RT 8.1
• Microsoft Windows 10 (versions 1507, 1607, 1709, 1803, 1809, 1903, 1909)
• Microsoft Windows Server 2008 SP2 and R2 SP1
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016 and 2019

Discovery Timeline

• April 15, 2020 - CVE-2020-0968 published to NVD
• October 29, 2025 - Last updated in NVD database

Technical Details for CVE-2020-0968

Vulnerability Analysis

This vulnerability exists within Internet Explorer's JavaScript scripting engine (jscript9.dll), which improperly handles objects in memory during script execution. The flaw occurs when the scripting engine fails to properly validate and manage object references, leading to memory corruption conditions that can be leveraged for arbitrary code execution.

The attack requires user interaction—specifically, a user must navigate to a malicious webpage or open a specially crafted document that embeds Internet Explorer content. The complexity of exploitation is relatively high as it requires bypassing modern exploit mitigations such as ASLR and DEP, but the potential impact is severe given full code execution capabilities.

Root Cause

The root cause stems from improper memory management within the JScript scripting engine. When handling certain JavaScript objects, the engine fails to correctly track object lifetimes and memory allocations. This results in an out-of-bounds write condition (CWE-787) where the scripting engine writes data outside the intended memory boundaries, corrupting adjacent memory structures.

The vulnerability is distinct from but related to CVE-2020-0970, another scripting engine memory corruption issue addressed in the same security update cycle.

Attack Vector

The attack vector is network-based and requires user interaction to trigger. An attacker could exploit this vulnerability through several methods:

1. Malicious Website: The attacker hosts a specially crafted webpage designed to exploit the vulnerability when rendered by Internet Explorer
2. Malvertising: Embedding malicious scripts within compromised advertising networks to reach victims at scale
3. Spear-phishing: Sending targeted emails containing links to exploit pages or HTML attachments that render in Internet Explorer
4. Document Embedding: Leveraging embedded browser controls in Microsoft Office documents that use the IE rendering engine

The vulnerability requires the victim to interact with malicious content, typically by visiting a webpage. Once triggered, the memory corruption can be chained with heap spray techniques and ROP gadgets to achieve reliable code execution.

Detection Methods for CVE-2020-0968

Indicators of Compromise

• Unusual crash events in iexplore.exe or processes using the IE scripting engine components
• Suspicious network connections originating from Internet Explorer to unknown or recently registered domains
• Anomalous child process spawning from iexplore.exe, particularly command shells or PowerShell instances
• Memory allocation patterns indicative of heap spraying activity in browser processes
• Presence of heavily obfuscated JavaScript in network traffic or cached web content

Detection Strategies

• Monitor for Internet Explorer crash reports and Windows Error Reporting events related to jscript9.dll or jscript.dll
• Deploy network-based detection for exploit kit traffic patterns and known malicious JavaScript obfuscation techniques
• Enable Enhanced Security Configuration on Windows Server to restrict Internet Explorer attack surface
• Implement application whitelisting to detect unexpected processes spawned from browser contexts
• Correlate endpoint telemetry with threat intelligence feeds covering known exploitation campaigns

Monitoring Recommendations

• Enable Windows Defender Exploit Guard with Attack Surface Reduction rules targeting browser child process creation
• Configure audit logging for process creation events (Event ID 4688) with command-line auditing enabled
• Monitor memory integrity alerts from endpoint protection solutions for script engine anomalies
• Track DNS queries from browser processes for connections to suspicious domains
• Review Internet Explorer add-on and extension activity for unauthorized script execution

How to Mitigate CVE-2020-0968

Immediate Actions Required

• Apply the Microsoft security update released in April 2020 immediately to all affected systems
• Consider restricting or disabling Internet Explorer usage in favor of modern browsers like Microsoft Edge
• Enable Enhanced Protected Mode in Internet Explorer to reduce exploitation risk
• Block or restrict access to untrusted websites through web filtering and proxy controls
• Implement network segmentation to limit lateral movement if exploitation occurs

Patch Information

Microsoft addressed this vulnerability in the April 2020 Patch Tuesday security update. The patch corrects how the scripting engine handles objects in memory, preventing the out-of-bounds write condition. Organizations should apply the cumulative security update for their specific Windows version and Internet Explorer release.

For detailed patch information, refer to the Microsoft Security Advisory CVE-2020-0968. Additionally, this vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, which mandates remediation for federal agencies.

Workarounds

• Restrict access to jscript.dll by modifying access control lists (ACLs) to prevent execution by Internet Explorer—note this may impact website functionality
• Configure Internet Explorer security zones to prompt or disable Active Scripting for the Internet zone
• Use Group Policy to deploy Internet Explorer restrictions across enterprise environments
• Deploy Enhanced Protected Mode and 64-bit processes for Internet Explorer where supported
• Consider application virtualization or containerization to isolate browser activity from critical systems

# Restrict access to JScript.dll as a temporary workaround (32-bit systems)
# Run as Administrator - Note: This may break website functionality
takeown /f %windir%\system32\jscript.dll
cacls %windir%\system32\jscript.dll /E /P everyone:N

# For 64-bit systems, also restrict the 64-bit version
takeown /f %windir%\syswow64\jscript.dll
cacls %windir%\syswow64\jscript.dll /E /P everyone:N

# To undo the workaround after patching:
# cacls %windir%\system32\jscript.dll /E /R everyone
# cacls %windir%\syswow64\jscript.dll /E /R everyone