ZDI-24-1658: Microsoft Edge File Extension Spoofing Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-49041.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-1658?
ZDI-24-1658 has a high severity rating as it allows remote code execution on affected installations of Microsoft Edge.
How do I fix ZDI-24-1658?
To fix ZDI-24-1658, ensure that you update to the latest version of Microsoft Edge as provided by Microsoft.
What versions of Microsoft Edge are affected by ZDI-24-1658?
ZDI-24-1658 affects installations of Microsoft Edge that are EdgeHTML-based.
Is user interaction required to exploit ZDI-24-1658?
Yes, user interaction is required for ZDI-24-1658, as the target must visit a malicious page or open a malicious file.
What type of attack does ZDI-24-1658 enable?
ZDI-24-1658 enables remote attackers to execute arbitrary code on affected Microsoft Edge installations.