CVE-2012-4969highunder attackCWE-416

CVE-2012-4969

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 80%
from disclosure to weapon22 days
Published on NVDSep 18
1st PoC+22d
metasploitSep 14
CISA KEV+3550d
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

A flaw in Internet Explorer allows attackers to run malicious code on your computer when you visit a crafted website. The browser incorrectly handles memory, letting attackers exploit this weakness to take control of your system.

Technical detail

Use-after-free vulnerability in CMshtmlEd::Exec function within mshtml.dll affects IE 6-9. Remote attackers can trigger arbitrary code execution by crafting malicious HTML content that causes the browser to access freed memory, resulting in privilege escalation and full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.