Windows MSHTML and IE-Engine Zero-Days of 2024 (6 CVEs)

What to do

1. Find Windows machines below the November 2024 build for their version (for example 22631.4460 on Windows 11 23H2) and install the current cumulative update.
2. On servers that take Security Only updates, also install the IE Cumulative Update, as Microsoft advises.
3. Set the Edge policy InternetExplorerIntegrationLevel to 0 wherever no site needs IE mode.
4. Ask vendors of desktop apps that embed the IE WebBrowser control for a supported replacement.
5. Block outbound SMB and WebDAV to the internet, and audit outgoing NTLM before restricting it.
6. Quarantine .url and .hta attachments from outside senders.

How to check if you are affected or compromised

• Compare each machine's CurrentBuild and UBR registry values with the November 2024 fixed builds.
• Search EDR for iexplore.exe launched from a .url file, or spawning mshta.exe or PowerShell, as in the Void Banshee chain.
• Search mail stores and shares for .url files whose URL line starts with mhtml:.
• Look for workstations sending SMB, WebDAV or NTLM traffic to internet hosts right after a user handled a .url file.

What happened#

Microsoft retired the Internet Explorer app in 2022, but its engine stayed in Windows. The MSHTML platform and the legacy scripting engines still ship because Edge's IE mode and other apps using the WebBrowser control depend on them, as Microsoft's CVE-2024-43461 FAQ explains. In 2024 attackers exploited six bugs in that leftover code as zero-days, and Tenable counted four in MSHTML alone. Microsoft rates each as needing user interaction, from opening a file to merely selecting it.

• CVE-2024-30040 (MSHTML bypass, CVSS 8.8, May 14, 2024). It bypasses the OLE mitigations in Microsoft 365 and Office. The user only has to load and "manipulate" a malicious file, not necessarily open it. Who used it was not disclosed as of Oct 23, 2026.
• CVE-2024-38112 (MSHTML spoofing, CVSS 7.5, Jul 9, 2024). Check Point's Haifei Li found .url files using an mhtml: prefix to open the retired IE and fetch an .hta file posing as a PDF. Samples ran from January 2023 to May 2024. Trend Micro tied a campaign using it to Void Banshee, which delivered the Atlantida stealer in North America, Europe and Southeast Asia.
• CVE-2024-43461 (MSHTML spoofing, CVSS 8.8, Sep 10, 2024). The other half of that chain. ZDI's advisory says a crafted file name hid the true extension in IE's download prompt. BleepingComputer reported 26 encoded braille blanks before ".hta". Microsoft marked it exploited on September 13 and says customers need both the July and September updates.
• CVE-2024-38178 (Scripting Engine type confusion, CVSS 7.5, Aug 13, 2024). Microsoft says the target must first be set to use Edge in IE mode. AhnLab and Korea's NCSC found North Korea's TA-RedAnt (APT37) reaching the same jscript9.dll engine another way. It breached a Korean ad agency and served exploit code to a "toast" ad program that rendered ads in IE-based WebView, with no user click.
• CVE-2024-43573 (MSHTML spoofing, CVSS 6.5, Oct 8, 2024). Exploited and publicly disclosed, with no attack details published.
• CVE-2024-43451 (NTLM hash disclosure, CVSS 6.5, Nov 12, 2024). Selecting or right-clicking a malicious file, without opening it, could leak the user's NTLMv2 hash. Microsoft credits ClearSky, which reported it in June 2024 after seeing .url files used against Ukrainian targets to deliver SparkRAT. CERT-UA linked them to UAC-0194, a suspected Russian actor, SecurityWeek reported.

Who is affected#

The CVE records cover the supported Windows 10, Windows 11 and Windows Server versions of 2024, back to Server 2008 SP2 for some CVEs. Cumulative updates carry fixes forward, so the November 12, 2024 update covers all six. Examples: 22631.4460 (KB5046633) on Windows 11 23H2, 26100.2314 (KB5046617) on 24H2 and Server 2025, 19045.5131 (KB5046613) on Windows 10 22H2 and 20348.2849 (KB5046616) on Server 2022. Servers on Security Only updates also need the IE Cumulative Update.

Do you really need to act?#

Mostly a check. Any machine on a cumulative update from November 2024 or later is fixed. Three things still deserve a look. Stragglers, first. Second, IE mode: Microsoft's scenario for CVE-2024-38178 needs it, and every MSHTML bug is easier to reach where Edge still opens sites in IE mode. Third, embedded IE: the AhnLab case shows third-party apps using the old engine expose it without anyone opening a browser. These components keep producing exploited bugs. KEV later added CVE-2025-30397 (scripting engine), CVE-2025-24054 (NTLM hash disclosure) and CVE-2026-21513 (MSHTML), so a 2024 patch level is not enough. The WordPad NTLM leak, CVE-2023-36563, followed the same pattern a year earlier.

What to do now#

1. Check builds with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR and move anything below the November 2024 floor to the current cumulative update.
2. Find IE mode: reg query HKLM\SOFTWARE\Policies\Microsoft\Edge /v InternetExplorerIntegrationLevel. A value of 1 means IE mode, per Microsoft's policy reference. Set 0 wherever no site needs it.
3. Ask vendors of desktop apps that embed the IE WebBrowser control for a supported replacement.
4. Block outbound SMB (TCP 445) and WebDAV to the internet, and audit outgoing NTLM before restricting it.
5. Quarantine .url and .hta attachments from outside senders.

How to tell if you were hit#

• Search EDR for iexplore.exe launched from a .url file, or spawning mshta.exe or PowerShell. Check Point says IE no longer opens this way after the July 2024 patches.
• Search mail stores and shares for .url files whose URL line starts with mhtml:.
• Look for workstations sending SMB, WebDAV or NTLM traffic to internet hosts right after a user handled a .url file.

Treat a hit on a then-unpatched machine as a compromise. Reimage it and reset the user's password: Microsoft says a leaked hash lets an attacker authenticate as the user.

Timeline#

• May 14, 2024 — CVE-2024-30040 fixed and added to KEV.
• May 16, 2024 — Check Point reports the .url trick to Microsoft.
• Jul 9, 2024 — CVE-2024-38112 fixed and added to KEV.
• Aug 13, 2024 — CVE-2024-38178 fixed and added to KEV.
• Sep 10, 2024 — CVE-2024-43461 fixed; CISA adds it to KEV on Sep 16.
• Oct 8, 2024 — CVE-2024-43573 fixed and added to KEV.
• Oct 16, 2024 — AhnLab and NCSC publish their APT37 report.
• Nov 12, 2024 — CVE-2024-43451 fixed and added to KEV.

Vulnerability records

• CVE-2024-30040 · KEV 2024-05-14 · Windows MSHTML Platform Security Feature Bypass Vulnerability
• CVE-2024-38112 · KEV 2024-07-09 · Windows MSHTML Platform Spoofing Vulnerability
• CVE-2024-43461 · KEV 2024-09-16 · Windows MSHTML Platform Spoofing Vulnerability
• CVE-2024-38178 · KEV 2024-08-13 · Scripting Engine Memory Corruption Vulnerability
• CVE-2024-43573 · KEV 2024-10-08 · Windows MSHTML Platform Spoofing Vulnerability
• CVE-2024-43451 · KEV 2024-11-12 · NTLM Hash Disclosure Spoofing Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2024-30040 Windows MSHTML Platform Security Feature Bypass Vulnerability msrc.microsoft.com
2. Microsoft MSRC — CVE-2024-38112 Windows MSHTML Platform Spoofing Vulnerability msrc.microsoft.com
3. Microsoft MSRC — CVE-2024-43461 Windows MSHTML Platform Spoofing Vulnerability msrc.microsoft.com
4. Microsoft MSRC — CVE-2024-38178 Scripting Engine Memory Corruption Vulnerability msrc.microsoft.com
5. Microsoft MSRC — CVE-2024-43573 Windows MSHTML Platform Spoofing Vulnerability msrc.microsoft.com
6. Microsoft MSRC — CVE-2024-43451 NTLM Hash Disclosure Spoofing Vulnerability msrc.microsoft.com
7. Microsoft MSRC — November 2024 Security Updates (CVRF) api.msrc.microsoft.com
8. CVE record — CVE-2024-43461 cve.org
9. CISA — Known Exploited Vulnerabilities: CVE-2024-43461 cisa.gov
10. Check Point Research — Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112) research.checkpoint.com
11. Trend Micro — CVE-2024-38112: Void Banshee Targets Windows Users Through Zero-Day trendmicro.com
12. Zero Day Initiative — ZDI-24-1207: Microsoft Windows Internet Explorer File Extension Spoofing Remote Code Execution Vulnerability zerodayinitiative.com
13. AhnLab ASEC — AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) asec.ahnlab.com
14. Microsoft Learn — Microsoft Edge policy InternetExplorerIntegrationLevel learn.microsoft.com
15. Tenable — Microsoft's October 2024 Patch Tuesday Addresses 117 CVEs (CVE-2024-43572, CVE-2024-43573) tenable.com

Coverage and analysis

1. BleepingComputer — Windows vulnerability abused braille spaces in zero-day attacks bleepingcomputer.com
2. SecurityWeek — Windows Zero-Day Exploited by Russia Triggered With File Drag-and-Drop, Delete Actions securityweek.com