What is the CVSS score of CVE-2026-57986?

CVE-2026-57986 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by CVE-2026-57986?

Microsoft Edge vulnerability CVE-2026-57986 (CVSS 7.5) enables unauthenticated remote code execution when users interact with attacker-controlled web content.. A patch is available.

How to fix or mitigate CVE-2026-57986?

Within 24 hours: Identify all systems running Microsoft Edge and determine scope of vulnerable versions. Within 7 days: Deploy Microsoft Edge patch per vendor advisory to all affected systems. Within 30 days: Verify patch deployment and report completion of remediation.

Microsoft Edge CVE-2026-57986

EUVD-2026-41578 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-7q4c-v8r2-pc77

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-delivered via web content (AV:N) but needs victim interaction (UI:R) and non-trivial heap grooming (AC:H), no privileges (PR:N); renderer-context RCE yields full C/I/A impact within unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:27 vuln.today

CVE Published

Jul 03, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory-corruption bug (CWE-416) that an unauthorized attacker can trigger over the network to run arbitrary code in the browser's context. Exploitation requires the victim to interact with attacker-controlled web content and the CVSS vector flags high attack complexity, so successful attacks are not trivial. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host malicious web page

Delivery

Lure victim to open it in Edge

Exploit

Trigger use-after-free in renderer

Execution

Reclaim freed object via heap grooming

Persist

Hijack control flow

Impact

Execute arbitrary code in browser

Access

Host malicious web page

Delivery

Lure victim to open it in Edge

Exploit

Trigger use-after-free in renderer

Execution

Reclaim freed object via heap grooming

Persist

Hijack control flow

Impact

Execute arbitrary code in browser

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively interact with attacker-controlled web content - per the CVSS vector UI:R means user interaction (such as visiting a malicious page or clicking a crafted link) is mandatory, so this is not a zero-click attack. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - network reachable and requiring no privileges, but gated by high attack complexity and required user interaction, which meaningfully lowers real-world exploitability compared with a no-interaction drive-by bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page (or injects malicious content into a compromised or malvertised site) that triggers the use-after-free when rendered. A victim using an unpatched Microsoft Edge browser is lured into visiting the page, and the crafted content manipulates freed heap memory to execute attacker code in the browser process. …
Remediation	Patch available per vendor advisory: update Microsoft Edge to the latest patched build published in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57986, which for Chromium-based Edge is delivered through the browser's automatic update channel (verify via edge://settings/help). … Detailed patch versions, workarounds, and compensating controls in full report.