Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2012-4792)
Severity: high · Patch status: unpatched · Since 2024-07-23 · CVE-2012-4792
Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object. CISA added CVE-2012-4792 to its Known Exploited Vulnerabilities catalog on Jul 23, 2024, which means attackers are exploiting it in the wild.
What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- US federal agencies must remediate by Aug 13, 2024 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
