Skip to content
Fencer Vulns
high 7.5

CVE-2019-1001 json

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scriptin…

published 2019-07-15 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-9589

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
8.1%
EPSS 8.1% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1004, CVE-2019-1056, CVE-2019-1059.

Patch / fix

  • microsoft chakracore 1.11.11

Exploit prediction

8.06% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C

Affected products

  • Microsoft Internet Explorer 11
  • Microsoft Internet Explorer 11 on Windows Server 2012
  • Microsoft Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems
  • Microsoft Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems
  • Microsoft Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems
  • Microsoft Microsoft Edge
  • Microsoft Microsoft Edge on Windows 10 Version 1903 for 32-bit Systems
  • Microsoft Microsoft Edge on Windows 10 Version 1903 for x64-based Systems
  • Microsoft Microsoft Edge on Windows 10 Version 1903 for ARM64-based Systems
  • Microsoft ChakraCore

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.