What is the CVSS score of EUVD-2026-41566?

EUVD-2026-41566 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by EUVD-2026-41566?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-57992, CVSS 7.5) that allows attackers to seize control of user systems when victims visit attacker-controlled websites.. A patch is available.

How to fix or mitigate EUVD-2026-41566?

Within 24 hours: Inventory all Microsoft Edge installations across the enterprise and establish a testing/deployment timeline. Within 7 days: Deploy the latest patched version of Microsoft Edge to all user endpoints and corporate systems. Within 30 days: Validate patch compliance across the organization, monitor endpoint telemetry for exploitation attempts, and document remediation status.

Microsoft Edge EUVD-2026-41566

| CVE-2026-57992 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-pwgr-7g5c-fjgv

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-delivered browser UAF needing victim navigation (UI:R) and complex heap grooming (AC:H); no privileges (PR:N), renderer-scoped (S:U) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:14 vuln.today

CVE Published

Jul 03, 2026 - 20:35 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated attacker run arbitrary code when a victim is lured into loading attacker-controlled web content that triggers a use-after-free memory corruption. The flaw carries a CVSS 3.1 base of 7.5 and requires user interaction, and the CVSS temporal metrics (E:U, RL:O, RC:C) indicate the issue is confirmed and officially patched with no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host malicious web page

Delivery

Lure victim to load page

Exploit

Trigger use-after-free in renderer

Execution

Reclaim freed object with controlled data

Impact

Execute code in browser context

Access

Host malicious web page

Delivery

Lure victim to load page

Exploit

Trigger use-after-free in renderer

Execution

Reclaim freed object with controlled data

Impact

Execute code in browser context

Vulnerability AssessmentAI

Exploitation	Exploitation requires a victim using Microsoft Edge (Chromium-based) to actively load attacker-controlled web content (UI:R) - for example clicking a link or visiting a malicious/compromised page - no authentication or prior privileges are needed (PR:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, unauthenticated flaw with high impact to confidentiality, integrity, and availability, but two factors materially lower real-world risk: high attack complexity (AC:H) reflects the non-deterministic heap grooming needed to weaponize a UAF, and required user interaction (UI:R) means the victim must actively load malicious content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page (or malvertising/compromised site) containing content crafted to trigger the use-after-free in Edge's rendering engine, then lures a victim into visiting it via a phishing link or malicious ad. When the page loads, the freed object is reclaimed with attacker-controlled data, yielding code execution in the renderer; high attack complexity means reliable exploitation requires careful heap grooming, and no public POC is currently known.
Remediation	Patch available per vendor advisory: update Microsoft Edge to the latest Stable channel build referenced in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57992 (an exact fixed version number was not provided in the input and should be taken from that advisory). … Detailed patch versions, workarounds, and compensating controls in full report.