VBScript Engine Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Foxit Studio Photo Out-of-bounds Read Vulnerability


VBScript Engine suffers from improper restriction of operations within the bounds of a memory buffer vulnerability


The information has been provided by Yuki Chen 

The original article can be found at: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1238


In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked “safe for initialization” in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.

Vulnerable Systems:

VBScript Engine 

CVE Information:


Disclosure Timeline:
Published Date:10/10/2019