cyfenced.com →

[ CVE-2012-4792 · Published 30 Dec 2012 ]

Microsoft Internet Explorer Use-After-Free Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 79%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-07-23
  • EPSS: 79% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

CISA: Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Aug 2024): The impacted product is end-of-life and should be disconnected if still in use.

[ References ]References