Technical intelligence and weaponization dossier for CVE-2016-0189. Documented exploitation across 4 active malware families totaling 9,993 analyzed telemetry samples.
| Vulnerability ID | CVE-2016-0189 |
|---|---|
| Common Name / Bulletin | Microsoft Internet Explorer & Edge Scripting Engine Memory Corruption (MS16-051) |
| CWE Classification | CWE-119: Memory Corruption in vbscript.dll |
| Affected Software & Versions | Microsoft Internet Explorer 9, 10, 11, Windows Vista, 7, 8.1, 10 |
| Technical Root Cause | Memory corruption in vbscript.dll when resizing arrays within SafeArray manipulation routines, exploited in targeted Korean water-holing and ransomware drops. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 4 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| ursnif | Banking Trojan | 8,188 | Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular ... |
| cerber | Ransomware | 1,792 | Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2016 and late 2017. Deve... |
| locky | Ransomware | 11 | Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
Threat intelligence confirms the following adversaries weaponize CVE-2016-0189 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2016-0189 in enterprise networks:
VBScript executing inside web sessions declaring multidimensional arrays resized in ReDim statements to trigger type confusion.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →