Microsoft JScript Engine Use-After-Free Remote Code Execution (CVE-2025-30397)

CVE-2025-30397 is a use-after-free vulnerability in the legacy JScript engine (jscript.dll) that allows for remote code execution. The vulnerability is triggered when a user is enticed to open a specially crafted HTML page using Internet Explorer 11. Publicly available proof-of-concept code demonstrates that attackers can use heap spraying techniques to gain stable memory corruption and execute arbitrary shellcode.

Impact

Successful exploitation allows for remote code execution with the privileges of the logged-in user. The vulnerability is explicitly noted as enabling the execution of arbitrary payloads, such as calc.exe, in proof-of-concept demonstrations.

Recommendation

• Identify systems running Internet Explorer 11 and assess the necessity of its continued use.
• Prioritize patching for the listed Windows versions as the public availability of exploit code increases the likelihood of exploitation.
• Disable or restrict access to jscript.dll if business requirements permit, as it is a frequent target for memory corruption attacks.
• Monitor for processes spawned by 'iexplore.exe' or the legacy JScript engine that deviate from standard browser operations.