Loading vulnerability…
CVE-2016-0189 is a memory corruption vulnerability in Microsoft's JScript 5.8 and VBScript 5.7/5.8 scripting engines as used by Internet Explorer 9 through 11 and related products. The flaw was patched in MS16-051 and was exploited in the wild. Available technical analysis indicates the issue involves improper handling of VBScript array access in vbscript.dll, specifically in the AccessArray path, where a missing SafeArray lock allows attacker-controlled script execution during index conversion and subsequent array resizing. By supplying an object whose value conversion triggers script execution, an attacker can alter the array while indexed access is being computed, creating an out-of-bounds condition that can be turned into arbitrary memory read/write. Analysis also describes a related unsafe-script policy logic flaw in IsUnsafeAllowed that could be combined with the memory corruption to bypass scripting safety restrictions. In practice, the vulnerability can be triggered by a crafted web page rendered in Internet Explorer, leading to remote code execution or denial of service.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a compact proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11 on Windows 10. It contains two exploit HTML files and two supporting C++ DLL source files. The main entry point is exploit/vbscript_bypass_pm.html, which combines VBScript heap/array corruption primitives with JavaScript helpers. The VBScript code builds exploitation primitives to obtain object addresses, leak memory, and overwrite the COleScript SafetyOption field at offset 0x174, effectively disabling VBScript safety restrictions ('god mode'). The first-stage HTML then downloads three attacker-controlled files from a hardcoded HTTP server at 172.16.100.1:8889: ieshell32.dll, ielocalserver.dll, and vbscript_godmode.html. It searches IE's low-integrity cache directories for those downloaded files, moves them into temporary locations, sets environment variables, creates a fake %SystemRoot% tree containing a malicious shell32.dll, and instantiates Shell.Application. That causes the fake shell32 DLL to load. support/ieshell32.cpp is a DLL hijack helper: on load, it restores the original SystemRoot, reads MyDllPath from the environment, and loads the second DLL (ielocalserver.dll) with altered search path semantics. support/ielocalserver.cpp implements a simple HTTP server bound to 127.0.0.1:5555 that serves the staged vbscript_godmode.html file whose path is passed via the stage2file environment variable. After staging, the first HTML redirects the browser to http://localhost:5555/vbscript_godmode.html. The second-stage HTML repeats the VBScript memory corruption technique to disable safety restrictions and then directly executes cmd via Shell.Application.ShellExecute. Overall, the repository demonstrates browser-based remote code execution in IE11 plus a localhost/Protected Mode bypass chain using staged DLL loading and a local HTTP server. It is a real exploit PoC, not merely a detector, and includes a basic but functional payload.
This repository is a proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11 on Windows 10. The exploit consists of two main HTML files (vbscript_bypass_pm.html and vbscript_godmode.html) that use a combination of VBScript and JavaScript to trigger the vulnerability, perform heap spraying, and manipulate memory structures to achieve arbitrary code execution. The exploit downloads and loads two malicious DLLs (ieshell32.dll and ielocalserver.dll), which are provided as C++ source files in the support directory. The ieshell32.dll is used to manipulate environment variables and load further payloads, while ielocalserver.dll sets up a local HTTP server to serve the second stage of the exploit. The final payload launches a command shell (cmd.exe) on the victim's machine. The exploit bypasses IE's Protected Mode, escalating privileges from low to medium integrity. The repository is structured with clear separation between exploit scripts and supporting DLLs, and includes a README with usage instructions. The attack vector is browser-based, requiring the victim to visit a malicious web page with IE11. Several fingerprintable endpoints are present, including hardcoded HTTP URLs and file paths used for payload delivery and execution.
This repository is a proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11 on Windows 10. The exploit consists of two main HTML files (vbscript_bypass_pm.html and vbscript_godmode.html) that use a combination of VBScript and JavaScript to trigger a use-after-free vulnerability, gain code execution, and bypass IE's Protected Mode. The exploit downloads and loads two malicious DLLs (ieshell32.dll and ielocalserver.dll), which are provided as C++ source files in the support directory. The DLLs are used to manipulate environment variables and serve the second stage of the exploit via a local HTTP server. The final payload is the execution of cmd.exe on the victim's machine, demonstrating arbitrary code execution. The exploit requires the victim to browse to the malicious HTML file using IE11, and the attacker must serve the exploit files and DLLs via a web server. The repository is well-structured, with clear separation between exploit scripts and supporting DLL code.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Internet Explorer vulnerability used as the primary exploit in the CNACOM web-based campaign to compromise targeted Taiwanese government-related visitors.
An Internet Explorer vulnerability used by the campaign's malicious HTML page to execute an embedded PowerShell script and deliver LokiBot.
A memory corruption vulnerability in Internet Explorer used by the Underminer exploit kit.
An older Internet Explorer vulnerability mentioned only as historical comparison to CVE-2018-8174.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.