Overview

A memory corruption vulnerability has been reported in Microsoft Windows Scripting Engine which could be exploited by a remote attacker to execute arbitrary code on the targeted system.

Description

A memory corruption vulnerability in the Windows Scripting Engine enables remote code execution attacks if an authenticated user is deceived into clicking a link, which allows an unauthenticated attacker to execute code remotely. To successfully exploit this vulnerability, an attacker must first configure the target to use Edge in Internet Explorer Mode.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the targeted system.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178