CVE-2012-4792 — Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and

01What is this vulnerability?

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

02Affected products

Vendor	Product	Versions
n	a / n/a	n/a

03Active exploitation status

Yes — actively exploited. Added to the CISA KEV catalog on 2024-07-23. Ransomware use: Unknown.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2012-12-30T18:00:00.000Z
• Last modified: 2025-10-22T00:05:45.500Z
• Added to CISA KEV: 2024-07-23
• BOD 22-01 due: 2024-08-13

09References

• www.us-cert.gov — http://www.us-cert.gov/cas/techalerts/TA13-008A.html
• docs.microsoft.com — https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-00…
• www.kb.cert.org — http://www.kb.cert.org/vuls/id/154201
• github.com — https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/wind…
• labs.alienvault.com — http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-…
• packetstormsecurity.com — http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBind…
• eromang.zataz.com — http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against…
• oval.cisecurity.org — https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3…
• www.us-cert.gov — http://www.us-cert.gov/cas/techalerts/TA13-015A.html
• blog.fireeye.com — http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-at…
• blogs.technet.com — http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-in…
• technet.microsoft.com — http://technet.microsoft.com/security/advisory/2794220
• blogs.technet.com — http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-ava…