CVE-2020-0674

What is jscript.dll?

jscript.dll is Internet Explorer's older, legacy JavaScript engine — retained for backward compatibility (used by IE11's "Compatibility View" and older Windows versions) alongside the more modern Chakra-based engine. Legacy compatibility code paths like this one, kept around for compatibility rather than active development, are a recurring source of Windows and IE vulnerabilities, since they see far less ongoing security scrutiny than actively maintained components.

Overview

CVE-2020-0674 is a use-after-free vulnerability (CWE-416) in Internet Explorer's scripting engine, allowing remote code execution in the context of the current user via a crafted web page (CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5 High). Microsoft published Security Advisory ADV200001 in January 2020, confirming limited, targeted in-the-wild exploitation nearly three weeks before shipping an official patch in February 2020 Patch Tuesday — one of several early-2020 cases of Microsoft acknowledging active exploitation ahead of a fix, alongside the Adobe Type Manager Library 0-days covered elsewhere on this site.

Technical Details

The vulnerable code mishandles objects in memory while executing scripting content in jscript.dll, allowing a specially crafted page to trigger a use-after-free condition that an attacker can exploit for code execution. The "High" attack complexity reflects that reliable exploitation requires more precise conditions than a straightforward memory bug.

Discovery

Reported to Microsoft by external security researchers ahead of the January 2020 advisory; some public reporting at the time associated the observed exploitation with a South Korea-linked threat campaign, though Microsoft's own advisory did not issue formal attribution to a specific named group.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Microsoft's decision to publish interim mitigation guidance via ADV200001 before a patch existed reflects the same pattern seen with the Adobe Type Manager Library 0-days that followed just two months later — genuine urgency driven by confirmed active exploitation, prioritizing defender awareness over the risk of publicizing an unpatched flaw.

Remediation

1. Apply Microsoft's February 2020 Patch Tuesday update immediately if not already installed.
2. Use Microsoft's interim mitigation from ADV200001 if immediate patching isn't possible — restricting jscript.dll from being loaded, or setting jscript9.dll as the default JScript engine registry setting for the affected zones.
3. Migrate away from Internet Explorer and legacy Compatibility View usage where organizationally feasible — legacy scripting engines like jscript.dll carry materially higher risk than actively maintained modern browser engines.
4. Treat any unpatched Windows/IE system as carrying confirmed-exploited risk for the roughly three-week window between the January 2020 advisory and the February 2020 patch.