CVE-2012-4792KEV · OVERDUE

Microsoft Internet Explorer Use-After-Free Vulnerability

High · published December 30, 2012

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.6th percentile for exploit probability.

801
days past CISA
deadline
CVSS v3.1
8.8
EPSS
79%
Percentile
99.6
In the wild
Confirmed
What it is

🚨 A sneaky use-after-free vulnerability in Internet Explorer 6 to 8 could let attackers execute arbitrary code with just a visit to a crafted website! ⚡ Think of this like a chef who leaves a dangerous knife out on the counter after finishing a dish. If someone comes along before it’s put away, they could use it to cut their own slice of chaos! 🍰 The consequences are absolutely devastating! An attacker could hijack your system, install malware, or steal sensitive information—basically, take over your computer without you even realizing it! This vulnerability was notably exploited in the wild back in December 2012, which means it's a serious issue to address quickly.

Put simply

Think of this like a chef who leaves a dangerous knife out on the counter after finishing a dish. If someone comes along before it’s put away, they could use it to cut their own slice of chaos! 🍰 This use-after-free vulnerability occurs when Internet Explorer accesses an object that has already been deleted or not properly allocated, leading to arbitrary code execution. Specifically, it's linked to the mishandling of a CDwnBindInfo object.

What to do

The consequences are absolutely devastating! An attacker could hijack your system, install malware, or steal sensitive information—basically, take over your computer without you even realizing it! This vulnerability was notably exploited in the wild back in December 2012, which means it's a serious issue to address quickly. To protect yourself, immediately upgrade to a modern browser that isn't affected by this flaw. If you're still using IE6-8 for some reason (yikes!), make sure to apply the latest security patches from Microsoft and consider transitioning to a more secure browsing experience. 🛡️ You've got this! Taking these steps will help you reclaim security and keep those pesky attackers at bay! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.78823 · 99.6th percentile
Published
2012-12-30T18:00Z
KEV added
2024-07-23 · due 2024-08-13
EPSS history
Timeline
  • 23 JUL 00:00Z
    Added to CISA KEV — remediate by Aug 13
    kev
  • 30 DEC 18:00Z
    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers…
    cvelistv5