CVE-2016-0189

The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

7.6 HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C

EPSS

94.06% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-03-28, used in ransomware campaigns

Published

2016-05-11

Updated

2025-10-21

Proof-of-concept exploits (4)

• https://www.virusbulletin.com/virusbulletin/2017/01/journey-and-evolution-god-mode-2016-c…
• deamwork/MS16-051-poc3★ · 2016-06-25
• nao-sec/RigEK50★ · 2017-05-17
• theori-io/cve-2016-0189114★ · 2016-06-23

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms16_051_vbscrip…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40118

References

• CVE Record
• NVD entry

Related

• CVE-2014-6332
• CVE-2015-2419
• CVE-2016-0187
• CVE-2018-4878
• CVE-2016-7200
• CVE-2016-7201