CVE-2019-0541

Microsoft MSHTML Remote Code Execution Vulnerability

Exploited in attacks High 8.8 Attack chance: 53%

What it is

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.

CISA: Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: January 8, 2019
Severity: High 8.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 53% in the top 1.0% of all known vulnerabilities
Weakness: CWE-77
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Microsoft

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Remote Code ExecutionCVE-2021-40444used by ransomware	MSHTML	High 8.8	98%
Oct 13, 2026	Command InjectionCVE-2026-96951	Windows	High 8.8	9.8%
Sep 25, 2026	Code InjectionCVE-2026-65660	SharePoint	High 8.8	8.2%
Sep 8, 2026	Link FollowingCVE-2026-81963	Windows	High 7.8	0.4%
Sep 8, 2026	Heap-Based Buffer OverflowCVE-2026-85880	Windows	High 7.8	0.4%
Aug 26, 2026	Remote Code ExecutionCVE-2019-1068	SQL Server	High 8.8	57%
Aug 18, 2026	Double FreeCVE-2026-33824	Internet Key Exchange (IKE) Service Extensions	Critical 9.8	77%
Aug 18, 2026	Weak AuthenticationCVE-2026-55040	SharePoint	Critical 9.1	70%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.