Scripting Engine Memory Corruption Vulnerability
Priority MEDIUM 53CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Scripting Engine Memory Corruption Vulnerability
Why it matters now
EPSS 0.22767 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Internet Explorer 11 (Microsoft): 10.0.14393.4401, 10.0.17134.2207, 10.0.17763.1935 +9Internet Explorer 9 (Microsoft): 6.0.6003.21117, 6.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Internet Explorer 11 | 1.0.0 to before 10.0.14393.4401; 1.0.0 to before 10.0.17134.2207; 1.0.0 to before 10.0.17763.1935; 1.0.0 to before 10.0.18363.1556; 1.0.0 to before 10.0.19041.982; 1.0.0 to before 10.0.10240.18931; 1.0.0 to before 6.1.7601.24597; 1.0.0 to before 6.1; 1.0.0 to before 6.3.9600.20017; 1.0.0 to before 6.3.9600.20016; 1.0.0 to before 6.2.9200.23347; 1.0.0 to before 6.2 | 10.0.14393.4401, 10.0.17134.2207, 10.0.17763.1935, 10.0.18363.1556, 10.0.19041.982, 10.0.10240.18931, 6.1.7601.24597, 6.1, 6.3.9600.20017, 6.3.9600.20016, 6.2.9200.23347, 6.2 | Patch available | CNA |
| Microsoft | Internet Explorer 9 | 1.0.0 to before 6.0.6003.21117; 1.0.0 to before 6.0 | 6.0.6003.21117, 6.0 | Patch available | CNA |
- Internet Explorer 11 VendorMicrosoft Affected 1.0.0 to before 10.0.14393.4401; 1.0.0 to before 10.0.17134.2207; 1.0.0 to before 10.0.17763.1935; 1.0.0 to before 10.0.18363.1556; 1.0.0 to before 10.0.19041.982; 1.0.0 to before 10.0.10240.18931; 1.0.0 to before 6.1.7601.24597; 1.0.0 to before 6.1; 1.0.0 to before 6.3.9600.20017; 1.0.0 to before 6.3.9600.20016; 1.0.0 to before 6.2.9200.23347; 1.0.0 to before 6.2 Fixed in 10.0.14393.4401, 10.0.17134.2207, 10.0.17763.1935, 10.0.18363.1556, 10.0.19041.982, 10.0.10240.18931, 6.1.7601.24597, 6.1, 6.3.9600.20017, 6.3.9600.20016, 6.2.9200.23347, 6.2 Patch available CNA
- Internet Explorer 9 VendorMicrosoft Affected 1.0.0 to before 6.0.6003.21117; 1.0.0 to before 6.0 Fixed in 6.0.6003.21117, 6.0 Patch available CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:* | 11 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:* | 20h2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* | 1803 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* | 1809 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* | 1909 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* | 2004 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:* Versions 11 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:* Versions 20h2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* Versions 1803 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* Versions 1909 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* Versions 2004 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* | r2 sp1 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:* | 9 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Microsoft
Remediation
- Fix · CNA Internet Explorer 11 (Microsoft) Fixed in 10.0.14393.4401, 10.0.17134.2207, 10.0.17763.1935, 10.0.18363.1556, 10.0.19041.982, 10.0.10240.18931, 6.1.7601.24597, 6.1, 6.3.9600.20017, 6.3.9600.20016, 6.2.9200.23347, 6.2
- Fix · CNA Internet Explorer 9 (Microsoft) Fixed in 6.0.6003.21117, 6.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26419
- 2026-10-03 Alias added: GHSA-4qh5-35r2-7932
References
More Microsoft Internet Explorer vulnerabilities
- TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-01386 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01340 Scripting Engine Memory Corruption Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2019-00335 Command injection in Microsoft Office KEVCVSS 3.1HIGH 8.8
- TI-2017-00204 Out-of-bounds write in Microsoft Internet Explorer KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2021-26419 · CVE Program
- CVE-2021-26419 · NVD
- FIRST EPSS
- GHSA-4qh5-35r2-7932 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences