CVE-2021-26411: high-severity vulnerability in Microsoft Internet Explorer 11
Internet Explorer Memory Corruption Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
Internet Explorer has a memory corruption flaw that allows attackers to crash the browser or potentially execute malicious code when visiting specially crafted websites. This is dangerous because it affects millions of Windows users who still rely on Internet Explorer.
A use-after-free vulnerability (CWE-416) in Internet Explorer allows remote code execution through malicious web content. The attack requires user interaction (visiting a crafted webpage), and successful exploitation can lead to arbitrary code execution with the privileges of the affected user.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.