What is the CVSS score of EUVD-2026-41649?

EUVD-2026-41649 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Edge are affected by EUVD-2026-41649?

Microsoft Edge contains a remote code execution vulnerability (CVE-2026-57984) that can be triggered when users visit attacker-controlled websites, creating direct risk to employee endpoints and…. A patch is available.

How to fix or mitigate EUVD-2026-41649?

Within 24 hours: Assess Microsoft Edge deployment scope across infrastructure and initiate patch distribution planning with IT operations. Within 7 days: Deploy the latest Microsoft Edge security update containing the CVE-2026-57984 fix to all organizational endpoints via standard patch management processes. Within 30 days: Confirm 100% deployment compliance and review endpoint telemetry for any exploitation attempts occurring before patch application.

Microsoft Edge EUVD-2026-41649

| CVE-2026-57984 HIGH

Use After Free (CWE-416)

2026-07-03 microsoft

GHSA-wf54-w5mv-jcf9

Memory Corruption Google Microsoft Denial Of Service Use After Free Microsoft Edge Chromium Based

7.5

CVSS 3.1 · NVD

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Remote drive-by via web content needs no auth (PR:N) but requires the victim to load a page (UI:R) and non-trivial heap grooming (AC:H); a renderer UAF yields full C/I/A compromise within the process (S:U).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:10 vuln.today

CVE Published

Jul 03, 2026 - 20:35 cve.org

HIGH 7.5

DescriptionNVD

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw that an unauthenticated attacker can trigger over the network when a victim loads attacker-controlled web content. Microsoft has released an official fix and rates the issue 7.5 (High), tempered by high attack complexity and required user interaction; the CVSS temporal data marks exploit maturity as Unproven (E:U), so there is no public exploit identified at time of analysis and no CISA KEV listing. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to malicious page

Delivery

Deliver crafted web content

Exploit

Trigger use-after-free in renderer

Execution

Groom heap and reclaim freed object

Impact

Execute arbitrary code in browser

Access

Lure victim to malicious page

Delivery

Deliver crafted web content

Exploit

Trigger use-after-free in renderer

Execution

Groom heap and reclaim freed object

Impact

Execute arbitrary code in browser

Vulnerability AssessmentAI

Exploitation	Exploitation requires user interaction (UI:R): the victim must actively load attacker-controlled web content in a vulnerable Microsoft Edge (Chromium-based) build - for example, visit a malicious site or open crafted web content in the browser. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals converge on a genuine-but-not-emergency priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page (or injects malicious script into a compromised or ad-served page) that drives Edge's rendering engine into the vulnerable code path, freeing an object and then reusing the dangling reference to corrupt heap memory. When a social-engineered victim visits the page, the use-after-free is groomed into code execution in the renderer. …
Remediation	Patch available per vendor advisory: update Microsoft Edge to the current patched build via the browser's built-in updater (edge://settings/help) or your managed-update tooling, then restart the browser to apply it; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57984 for the exact fixed version. … Detailed patch versions, workarounds, and compensating controls in full report.