{"id":"CVE-2019-0541","published":"2019-01-08T21:29:00Z","modified":"2026-06-17T02:08:19Z","title":"Microsoft MSHTML Remote Code Execution Vulnerability","vendor":"Microsoft","product":"MSHTML","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka \"MSHTML Engine Remote Code Execution Vulnerability.\" This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.","provenance":"source","from":"NVD"},"summary":{"text":"The Microsoft MSHTML engine improperly validates input, allowing remote code execution in the MSHTML component as used by Microsoft Office, Microsoft Office Word Viewer, Microsoft Excel Viewer, Internet Explorer 9, 10 and 11, and Office 365 ProPlus. An attacker over the network with no privileges needs a user to interact with a crafted document or web content, such as opening or viewing it, in order to execute code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:13Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.53202,"percentile":0.98981,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0541","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-11-03","exploitedFirstSeen":"2021-11-03","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"http://www.securityfocus.com/bid/106402","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46536/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/106402","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46536/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0541","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: User opens malicious document or page, triggering engine","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input","start":0,"end":105}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote code execution via MSHTML engine","mappingType":"primary_impact","evidence":[{"from":"description","quote":"remote code execution vulnerability exists in the way that the MSHTML engine","start":2,"end":78}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-1313","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1313","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":46536,"url":"https://www.exploit-db.com/exploits/46536","title":"Microsoft Windows MSHTML Engine - 'Edit' Remote Code Execution","type":"local","platform":"windows","date":"2019-03-13","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-03-13"},"first":{"date":"2019-03-13","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46536"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46536/"],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-01-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0541","provenance":"source"},{"date":"2019-03-13","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-46536)","url":"https://www.exploit-db.com/exploits/46536","provenance":"source"},{"date":"2021-11-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1313","provenance":"source"}],"speed":{"daysToPublicExploit":64,"firstExploitFrom":"Exploit-DB","daysToKev":1030},"priority":{"score":69.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1823 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9898"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}