Microsoft Internet Explorer Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
• EPSS: 77% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."

CISA: A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Mar 2022): Apply updates per vendor instructions.

• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under…Broken LinkVendor Advisory
• www.us-cert.gov/ncas/alerts/TA13-288AThird Party AdvisoryUS Government Resource
• docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080PatchVendor Advisory
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18989Broken Link
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource