CVE-2019-0541

Microsoft MSHTML engine had an improper input validation flaw allowing remote code execution via malicious Office documents.

The MSHTML engine in Microsoft products contained an improper input validation vulnerability that allowed remote code execution when users opened specially crafted malicious Office documents. DIB organizations must ensure all Microsoft products are patched, as this vulnerability was actively exploited in the wild and could lead to system compromise. The failure highlights the risk of relying on legacy browser engines and the necessity of timely patching to prevent remote code execution attacks.

Shame score — The vulnerability was actively exploited in the wild, indicating a failure to patch a known issue before it was weaponized, which is a severe and avoidable security lapse.