CVE-2015-2419

HIGH KEV RANSOMWARE

Internet Explorer 10 and 11 - Remote Code Execution via JScript9 Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2015-2419 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022, with confirmed use in ransomware campaigns. EIP tracks 1 public exploit from researchers including checkpoint.

AI-analyzed exploit summary This exploit leverages a use-after-free vulnerability in Microsoft Internet Explorer (CVE-2015-2419) to achieve remote code execution. It employs heap spraying, memory corruption, and ROP chains to bypass DEP and execute arbitrary shellcode (e.g., launching calc.exe).

Description

JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."

Exploits (1)

exploitdb WORKING POC
by checkpoint · htmllocalwindows
https://www.exploit-db.com/exploits/44743

This exploit leverages a use-after-free vulnerability in Microsoft Internet Explorer (CVE-2015-2419) to achieve remote code execution. It employs heap spraying, memory corruption, and ROP chains to bypass DEP and execute arbitrary shellcode (e.g., launching calc.exe).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: Microsoft Internet Explorer (versions 6-11)
No auth needed
Prerequisites: Victim must visit a malicious webpage hosting the exploit · Target system must be running a vulnerable version of Internet Explorer
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032894
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-065

Scores

CVSS v3 8.8
EPSS 0.4953
EPSS Percentile 97.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-03-28
VulnCheck KEV 2015-07-21
InTheWild.io 2022-03-28
ENISA EUVD EUVD-2015-2512
Ransomware Use Confirmed
CWE
CWE-787
Status published
Products (2)
microsoft/internet_explorer 10
microsoft/internet_explorer 11
Published Jul 14, 2015
KEV Added Mar 28, 2022
Tracked Since Feb 18, 2026