Executive brief
Microsoft JScript is a JavaScript interpreter used in Windows systems and Internet Explorer. A heap-based buffer overflow in JScript can allow an attacker to execute malicious code on vulnerable systems through network access, potentially compromising system integrity and enabling malware installation or data theft.
Technical details
This vulnerability is a heap-based buffer overflow in Microsoft JScript's memory management, allowing an attacker to write data beyond allocated buffer boundaries. The flaw can be exploited over the network without requiring authentication, though it may require user interaction (such as visiting a malicious webpage or opening a crafted document). Successful exploitation grants an attacker arbitrary code execution with the privileges of the JScript process, potentially leading to system compromise. Microsoft has released security updates to address this issue.
Affected products
- Microsoft JScript
Timeline
- 2026-09-08: disclosed