CVE-2012-4792
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
Analysis
Internet Explorer 6 through 8 contain a use-after-free vulnerability in CDwnBindInfo object handling that allows remote code execution through crafted websites, exploited as a zero-day in December 2012.
Technical Context
The CWE-416 use-after-free occurs when IE improperly frees a CDwnBindInfo object while it is still referenced by other components. Accessing the freed memory through a dangling pointer allows attackers to control execution flow, typically using heap spraying to place shellcode at predictable addresses.
Affected Products
['Microsoft Internet Explorer 6', 'Microsoft Internet Explorer 7', 'Microsoft Internet Explorer 8']
Remediation
These IE versions are end-of-life. Migrate to modern browsers (Edge, Chrome, Firefox). Apply Microsoft security update MS13-008 for legacy systems that cannot be upgraded.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today