CVE-2012-4792
HighActively exploited (CISA KEV)
Description
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Microsoft Internet Explorer
PublishedDec 30, 2012
First seenDec 30, 2012
Added to KEVJul 23, 2024
Weakness typeCWE-416Use after free
How to fix
CISA required action
The impacted product is end-of-life and should be disconnected if still in use.
CISA due date: Aug 13, 2024Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft internet_explorer | 6, 7, 8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.