CVE-2024-38112: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows MSHTML Platform Spoofing Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in Windows MSHTML allows attackers to spoof web content, making malicious websites appear as if they come from trusted sources. This tricks users into trusting fake or manipulated web pages.
This MSHTML vulnerability enables platform spoofing attacks where an attacker crafts malicious HTML content that misrepresents its origin or security context. The attack requires user interaction (CWE-451: User Interface (UI) Misrepresentation of Critical Information) and can lead to social engineering, credential theft, or malware distribution when users are deceived about the authenticity of web content.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.