VulnerabilityAnalyzed

CVE-2012-4792

Microsoft Internet Explorer Use-After-Free Vulnerability

KEVEXPLOIT ×2 ✓HIGH 8.8EPSS 78.8%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 13 August 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 78.82% probability · 100th percentile
Public exploits: 2 in Exploit-DB · verified · first 31 December 2012
CISA KEV: Listed 23 July 2024 · due 13 August 2024
Weakness: CWE-416
Affected: microsoft/internet explorer
Source: secure@microsoft.com

EPSS trend

EPSS 78.8% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

The impacted product is end-of-life and should be disconnected if still in use. https://learn.microsoft.com/en-us/lifecycle/products/internet-explorer-11; https://nvd.nist.gov/vuln/detail/CVE-2012-4792

Public exploits (2)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-23785 source ↗	Microsoft Internet Explorer - CButton Object Use-After-Free (Metasploit)windows · Metasploit	remote	2 January 2013	yes
EDB-23754 source ↗	Microsoft Internet Explorer - CDwnBindInfo Object Use-After-Free (Metasploit)windows · Metasploit	remote	31 December 2012	yes

References

http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.htmlBroken Link
http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspxBroken Link
http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspxBroken Link
http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/Third Party Advisory
http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/Broken Link
http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.htmlThird Party Advisory, VDB Entry
http://technet.microsoft.com/security/advisory/2794220Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/154201Third Party Advisory, US Government Resource
http://www.us-cert.gov/cas/techalerts/TA13-008A.htmlThird Party Advisory, US Government Resource
http://www.us-cert.gov/cas/techalerts/TA13-015A.htmlThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008Patch, Vendor Advisory
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rbThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361Broken Link
http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.htmlBroken Link
http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspxBroken Link
http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspxBroken Link
http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/Third Party Advisory
http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/Broken Link
http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.htmlThird Party Advisory, VDB Entry
http://technet.microsoft.com/security/advisory/2794220Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/154201Third Party Advisory, US Government Resource
http://www.us-cert.gov/cas/techalerts/TA13-008A.htmlThird Party Advisory, US Government Resource
http://www.us-cert.gov/cas/techalerts/TA13-015A.htmlThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008Patch, Vendor Advisory
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rbThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.