Loading vulnerability…
Remote Code Execution in Microsoft Scripting Engine
CVE-2025-30397 is a type confusion vulnerability in the Microsoft Scripting Engine. Improper validation of object types while malicious content is rendered through Microsoft Edge in Internet Explorer Mode can cause memory corruption. An attacker can exploit the flaw by inducing an authenticated user to follow a specially crafted link, enabling remote arbitrary code execution on the affected system. The vulnerability was actively exploited as a zero-day.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables an unauthorized remote attacker to execute arbitrary code on an affected system. This may provide unauthorized control of the system and facilitate deployment of follow-on payloads such as ransomware or credential-stealing malware.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, disable Microsoft Edge Internet Explorer Mode where operationally feasible. Migrate legacy applications away from IE compatibility dependencies, and monitor endpoints for anomalous process creation and unusual memory-access activity associated with exploit attempts.
Patch, then assume compromise.
Install Microsoft’s May 2025 security updates for all affected Windows client and Windows Server products. Updates identified for this issue include KB5058405 for Windows 10 and KB5058411 for Windows 11.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.