---
title: "IE CVE-2012-4792: 2012 Watering-Hole Zero-Day in KEV"
url: https://erroneo.us/security/briefs/internet-explorer-cve-2012-4792-cbutton-use-after-free/
description: "An IE 6-8 zero-day served from the CFR website in December 2012, fixed by MS13-008, joined CISA KEV in July 2024. Only legacy Windows hosts are at risk."
type: security-brief
section: "Security Digest"
date_published: 2012-12-29
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2012-4792"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# IE CVE-2012-4792: 2012 Watering-Hole Zero-Day in KEV

**Verdict: Most can relax.** This bug only affects IE 6, 7 and 8 and was patched in January 2013; the only real exposure is a forgotten legacy Windows machine, which should be isolated and replaced rather than patched bug by bug.

- **Who must act:** Anyone still running Windows XP, Server 2003, Vista, Server 2008, or Windows 7 or Server 2008 R2 with IE 8, such as old kiosks, lab PCs or plant-floor workstations.
- **Who can relax:** Everyone on supported Windows with Microsoft Edge, Edge's IE mode, or IE 9 and later; MS13-008 says IE 9 and IE 10 were not affected.
- **Affected:** Internet Explorer 6 on Windows XP and Server 2003; Internet Explorer 7 on Windows XP, Server 2003, Vista and Server 2008; Internet Explorer 8 on Windows XP, Server 2003, Vista, Server 2008, Windows 7 and Server 2008 R2
- **Fixed:** MS13-008, Security Update for Internet Explorer (KB2799329), Jan 14, 2013; Any later cumulative IE update for the same system
- **CVEs:** CVE-2012-4792
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Search your inventory for Windows XP, Server 2003, Vista and Server 2008 hosts, and for Windows 7 or Server 2008 R2 machines still on IE 8.
2. Replace or upgrade those systems; if one must stay, confirm MS13-008 (KB2799329) or a later IE cumulative update is installed.
3. Do not rely on workarounds such as the 2012 Fix it shim, which Exodus Intelligence bypassed within a day.
4. Block legacy hosts from browsing the internet and reading email, and isolate them on their own segment.
5. Leave Edge and IE mode settings on supported Windows alone; they are not affected.

### How to check if you are affected

- On a legacy host, run reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer" /v Version to read the IE version.
- Run systeminfo or wmic qfe list and look for KB2799329 or a later IE cumulative update.
- Review proxy logs for hosts that send MSIE 6.0, 7.0 or 8.0 user agents.

## What happened

Around Christmas 2012, attackers served an Internet Explorer zero-day from the website of the Council on Foreign Relations (CFR), a US think tank. [The Register](https://www.theregister.com/2013/01/02/ie_0_day_patch/) reported that FireEye found it on the site on December 27, and that the attack had run for at least a week. [The Hacker News](https://thehackernews.com/2024/07/cisa-adds-twilio-authy-and-ie-flaws-to.html) adds that the Capstone Turbine Corporation website was also used.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2012-4792) gives December 29, 2012 as the public date and describes a use-after-free in IE 6 through 8. CERT/CC's [VU#154201](https://www.kb.cert.org/vuls/id/154201) says crafted JavaScript freed a `CButton` object while a pointer to it remained, and that the live exploit used Adobe Flash for a heap spray. Microsoft's first answer was Security Advisory 2794220 and a Fix it shim. Exodus [bypassed the shim](https://blog.exodusintel.com/2013/01/04/bypassing-microsofts-internet-explorer-0day-fix-it-patch-for-cve-2012-4792/) after "less than a day of reverse engineering" and reported it to Microsoft. The real fix, [MS13-008](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008) (KB2799329), shipped on January 14, 2013. It credits Exodus and confirms "targeted attacks" through IE 8. Exploit code is public as a [Metasploit module](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb).

On July 23, 2024, CISA [added](https://www.cisa.gov/news-events/alerts/2024/07/23/cisa-adds-two-known-exploited-vulnerabilities-catalog) the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792) with a Twilio Authy bug, "based on evidence of active exploitation." It gave no new details, and The Hacker News wrote that it was "currently not clear" whether the bug had been exploited again. We found no later public report as of Oct 23, 2026. The 2012 attacks are documented exploitation in their own right. KEV's required action says the product "is end-of-life and should be disconnected if still in use."

## Who is affected

Per MS13-008, IE 6, 7 and 8 on Windows XP, Server 2003, Vista, Server 2008, Windows 7 and Server 2008 R2. IE 9 and IE 10 were not affected. Microsoft rated it Critical on clients and Moderate on servers, where IE's Enhanced Security Configuration mitigates it. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2012-4792) scores it CVSS 3.1 8.8.

## Do you really need to act?

Almost certainly not. Microsoft's [lifecycle FAQ](https://learn.microsoft.com/en-us/lifecycle/faq/internet-explorer-microsoft-edge) lists IE 9 or IE 11 for every desktop and server Windows release it still covers. Even IE 11 lost support on Windows 10 semi-annual channel on June 15, 2022, per the [IE 11 lifecycle page](https://learn.microsoft.com/en-us/lifecycle/products/internet-explorer-11) that CISA cites. The attack also needs a user to visit a malicious or compromised page.

The exception is the forgotten box, such as an XP or Windows 7 machine running a kiosk, a lab instrument or a plant-floor HMI. This bug also shows that a workaround is not a fix: Exodus beat this one in a day. CISA has since added other old IE bugs to KEV: CVE-2013-3893, CVE-2010-3962 (it has its own brief), CVE-2010-0249 and CVE-2010-0806. Patching one CVE does not make IE 8 safe. Isolation and replacement do.

## What to do now

1. Search your inventory for XP, Server 2003, Vista and Server 2008 hosts, and for Windows 7 or Server 2008 R2 machines still on IE 8.
2. Replace or upgrade them. If one must stay, confirm that MS13-008 or a later IE cumulative update is installed.
3. Block legacy hosts from browsing and email, and put them on an isolated segment.

## How to tell if you were hit

On a legacy host, run `reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer" /v Version` to read the IE version. Then check `wmic qfe list` or `systeminfo` for KB2799329 or a later IE update. In proxy logs, look for MSIE 6.0, 7.0 or 8.0 user agents. A machine that browsed the web on unpatched IE 8 for years should be treated as untrusted, so rebuild it rather than hunt for this one exploit.

## Timeline

- Dec 27, 2012 — FireEye finds the exploit on the CFR website.
- Dec 29, 2012 — Public date in the CVE record. CERT/CC publishes VU#154201.
- Jan 4, 2013 — Exodus Intelligence describes its bypass of the Fix it shim.
- Jan 14, 2013 — Microsoft releases MS13-008.
- Jul 23, 2024 — CISA adds CVE-2012-4792 to KEV.
- Aug 13, 2024 — Federal remediation deadline.

## Sources

1. [Microsoft — Security Bulletin MS13-008: Security Update for Internet Explorer (2799329)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008)
2. [CVE record — CVE-2012-4792](https://www.cve.org/CVERecord?id=CVE-2012-4792)
3. [NVD — CVE-2012-4792](https://nvd.nist.gov/vuln/detail/CVE-2012-4792)
4. [CISA — Known Exploited Vulnerabilities: CVE-2012-4792](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792)
5. [CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Jul 23, 2024)](https://www.cisa.gov/news-events/alerts/2024/07/23/cisa-adds-two-known-exploited-vulnerabilities-catalog)
6. [CERT/CC — VU#154201: Microsoft Internet Explorer CButton use-after-free vulnerability](https://www.kb.cert.org/vuls/id/154201)
7. [Exodus Intelligence — Happy New Year Analysis of CVE-2012-4792](https://blog.exodusintel.com/2013/01/02/happy-new-year-analysis-of-cve-2012-4792/)
8. [Exodus Intelligence — Bypassing Microsoft's Internet Explorer 0day Fix It Patch for CVE-2012-4792](https://blog.exodusintel.com/2013/01/04/bypassing-microsofts-internet-explorer-0day-fix-it-patch-for-cve-2012-4792/)
9. [Microsoft — Lifecycle: Internet Explorer 11](https://learn.microsoft.com/en-us/lifecycle/products/internet-explorer-11)
10. [Microsoft — Lifecycle FAQ: Internet Explorer and Microsoft Edge](https://learn.microsoft.com/en-us/lifecycle/faq/internet-explorer-microsoft-edge)
11. [Rapid7 — Metasploit module ie_cbutton_uaf (MS13-008)](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb)
12. [The Register — Microsoft scrambles to thwart new Internet Explorer 0-day attack](https://www.theregister.com/2013/01/02/ie_0_day_patch/)
13. [The Hacker News — CISA Adds Twilio Authy and IE Flaws to Exploited Vulnerabilities List](https://thehackernews.com/2024/07/cisa-adds-twilio-authy-and-ie-flaws-to.html)

---
Source page: https://erroneo.us/security/briefs/internet-explorer-cve-2012-4792-cbutton-use-after-free/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt