---
title: "Windows MSHTML and IE-Engine Zero-Days of 2024 (6 CVEs)"
url: https://erroneo.us/security/briefs/windows-mshtml-ie-mode-zero-days-cve-2024-38112/
description: "Six exploited 2024 bugs in Windows' leftover IE engine (MSHTML, JScript9, NTLM leak) hit via .url files and IE mode. Fixed by Nov 2024 updates; check IE mode."
type: security-brief
section: "Security Digest"
date_published: 2024-05-14
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-30040", "CVE-2024-38112", "CVE-2024-43461", "CVE-2024-38178", "CVE-2024-43573", "CVE-2024-43451"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows MSHTML and IE-Engine Zero-Days of 2024 (6 CVEs)

**Verdict: Check exposure.** Any Windows machine on a cumulative update from November 2024 or later is fixed; confirm there are no stragglers, turn off IE mode where nobody needs it, and keep outbound NTLM in check.

- **Who must act:** Teams with Windows machines that missed updates since November 2024, sites that still enable IE mode in Edge, and owners of desktop apps that embed the old IE WebBrowser control.
- **Who can relax:** Fleets on current cumulative updates with IE mode turned off, and headless servers nobody uses to browse or open mail.
- **Affected:** Windows 10, Windows 11 and Windows Server 2016 through 2022 before the May 14, 2024 update (CVE-2024-30040); Windows 10, Windows 11 and Windows Server (2008 SP2 or 2012 R2 through 2022, depending on the CVE) before the July 9, Aug 13, Sep 10 and Oct 8, 2024 updates (CVE-2024-38112, CVE-2024-38178, CVE-2024-43461, CVE-2024-43573); Windows 10, Windows 11 and Windows Server 2008 SP2 through 2025 before the Nov 12, 2024 update (CVE-2024-43451)
- **Fixed:** Windows 11 24H2 / Server 2025: KB5046617 (26100.2314); Windows 11 22H2/23H2: KB5046633 (22621/22631.4460); Windows 10 22H2: KB5046613 (19045.5131); Windows 10 1809 / Server 2019: KB5046615 (17763.6532); Windows 10 1607 / Server 2016: KB5046612 (14393.7515); Windows Server 2022: KB5046616 (20348.2849); Windows Server 2012 R2: KB5046682 (6.3.9600.22267); Security Only servers also need IE Cumulative Update KB5046630; Any later cumulative update
- **CVEs:** CVE-2024-30040, CVE-2024-38112, CVE-2024-43461, CVE-2024-38178, CVE-2024-43573, CVE-2024-43451
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find Windows machines below the November 2024 build for their version (for example 22631.4460 on Windows 11 23H2) and install the current cumulative update.
2. On servers that take Security Only updates, also install the IE Cumulative Update, as Microsoft advises.
3. Set the Edge policy InternetExplorerIntegrationLevel to 0 wherever no site needs IE mode.
4. Ask vendors of desktop apps that embed the IE WebBrowser control for a supported replacement.
5. Block outbound SMB and WebDAV to the internet, and audit outgoing NTLM before restricting it.
6. Quarantine .url and .hta attachments from outside senders.

### How to check if you are affected

- Compare each machine's CurrentBuild and UBR registry values with the November 2024 fixed builds.
- Search EDR for iexplore.exe launched from a .url file, or spawning mshta.exe or PowerShell, as in the Void Banshee chain.
- Search mail stores and shares for .url files whose URL line starts with mhtml:.
- Look for workstations sending SMB, WebDAV or NTLM traffic to internet hosts right after a user handled a .url file.

## What happened

Microsoft retired the Internet Explorer app in 2022, but its engine stayed in Windows. The MSHTML platform and the legacy scripting engines still ship because Edge's IE mode and other apps using the WebBrowser control depend on them, as Microsoft's [CVE-2024-43461 FAQ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461) explains. In 2024 attackers exploited six bugs in that leftover code as zero-days, and [Tenable](https://www.tenable.com/blog/microsoft-october-2024-patch-tuesday-addresses-117-cves-cve-2024-43572-cve-2024-43573) counted four in MSHTML alone. Microsoft rates each as needing user interaction, from opening a file to merely selecting it.

- **[CVE-2024-30040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040)** (MSHTML bypass, CVSS 8.8, May 14, 2024). It bypasses the OLE mitigations in Microsoft 365 and Office. The user only has to load and "manipulate" a malicious file, not necessarily open it. Who used it was not disclosed as of Oct 23, 2026.
- **[CVE-2024-38112](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112)** (MSHTML spoofing, CVSS 7.5, Jul 9, 2024). Check Point's Haifei Li [found](https://research.checkpoint.com/2024/resurrecting-internet-explorer-threat-actors-using-zero-day-tricks-in-internet-shortcut-file-to-lure-victims-cve-2024-38112/) .url files using an `mhtml:` prefix to open the retired IE and fetch an .hta file posing as a PDF. Samples ran from January 2023 to May 2024. Trend Micro [tied](https://www.trendmicro.com/en_us/research/24/g/CVE-2024-38112-void-banshee.html) a campaign using it to Void Banshee, which delivered the Atlantida stealer in North America, Europe and Southeast Asia.
- **CVE-2024-43461** (MSHTML spoofing, CVSS 8.8, Sep 10, 2024). The other half of that chain. ZDI's [advisory](https://www.zerodayinitiative.com/advisories/ZDI-24-1207/) says a crafted file name hid the true extension in IE's download prompt. [BleepingComputer](https://www.bleepingcomputer.com/news/security/windows-vulnerability-abused-braille-spaces-in-zero-day-attacks/) reported 26 encoded braille blanks before ".hta". Microsoft marked it exploited on September 13 and says customers need both the July and September updates.
- **[CVE-2024-38178](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178)** (Scripting Engine type confusion, CVSS 7.5, Aug 13, 2024). Microsoft says the target must first be set to use Edge in IE mode. [AhnLab and Korea's NCSC](https://asec.ahnlab.com/en/83877/) found North Korea's TA-RedAnt (APT37) reaching the same `jscript9.dll` engine another way. It breached a Korean ad agency and served exploit code to a "toast" ad program that rendered ads in IE-based WebView, with no user click.
- **[CVE-2024-43573](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573)** (MSHTML spoofing, CVSS 6.5, Oct 8, 2024). Exploited and publicly disclosed, with no attack details published.
- **[CVE-2024-43451](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451)** (NTLM hash disclosure, CVSS 6.5, Nov 12, 2024). Selecting or right-clicking a malicious file, without opening it, could leak the user's NTLMv2 hash. Microsoft credits ClearSky, which reported it in June 2024 after seeing .url files used against Ukrainian targets to deliver SparkRAT. CERT-UA linked them to UAC-0194, a suspected Russian actor, [SecurityWeek](https://www.securityweek.com/windows-zero-day-exploited-by-russia-triggered-with-file-drag-and-drop-delete-actions/) reported.

## Who is affected

The [CVE records](https://www.cve.org/CVERecord?id=CVE-2024-43461) cover the supported Windows 10, Windows 11 and Windows Server versions of 2024, back to Server 2008 SP2 for some CVEs. Cumulative updates carry fixes forward, so the [November 12, 2024 update](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov) covers all six. Examples: 22631.4460 (KB5046633) on Windows 11 23H2, 26100.2314 (KB5046617) on 24H2 and Server 2025, 19045.5131 (KB5046613) on Windows 10 22H2 and 20348.2849 (KB5046616) on Server 2022. Servers on Security Only updates also need the IE Cumulative Update.

## Do you really need to act?

Mostly a check. Any machine on a cumulative update from November 2024 or later is fixed. Three things still deserve a look. Stragglers, first. Second, IE mode: Microsoft's scenario for CVE-2024-38178 needs it, and every MSHTML bug is easier to reach where Edge still opens sites in IE mode. Third, embedded IE: the AhnLab case shows third-party apps using the old engine expose it without anyone opening a browser. These components keep producing exploited bugs. KEV later added CVE-2025-30397 (scripting engine), CVE-2025-24054 (NTLM hash disclosure) and CVE-2026-21513 (MSHTML), so a 2024 patch level is not enough. The WordPad NTLM leak, CVE-2023-36563, followed the same pattern a year earlier.

## What to do now

1. Check builds with `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR` and move anything below the November 2024 floor to the current cumulative update.
2. Find IE mode: `reg query HKLM\SOFTWARE\Policies\Microsoft\Edge /v InternetExplorerIntegrationLevel`. A value of 1 means IE mode, per Microsoft's [policy reference](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/internetexplorerintegrationlevel). Set 0 wherever no site needs it.
3. Ask vendors of desktop apps that embed the IE WebBrowser control for a supported replacement.
4. Block outbound SMB (TCP 445) and WebDAV to the internet, and audit outgoing NTLM before restricting it.
5. Quarantine .url and .hta attachments from outside senders.

## How to tell if you were hit

- Search EDR for `iexplore.exe` launched from a .url file, or spawning `mshta.exe` or PowerShell. Check Point says IE no longer opens this way after the July 2024 patches.
- Search mail stores and shares for .url files whose URL line starts with `mhtml:`.
- Look for workstations sending SMB, WebDAV or NTLM traffic to internet hosts right after a user handled a .url file.

Treat a hit on a then-unpatched machine as a compromise. Reimage it and reset the user's password: Microsoft says a leaked hash lets an attacker authenticate as the user.

## Timeline

- May 14, 2024 — CVE-2024-30040 fixed and added to KEV.
- May 16, 2024 — Check Point reports the .url trick to Microsoft.
- Jul 9, 2024 — CVE-2024-38112 fixed and added to KEV.
- Aug 13, 2024 — CVE-2024-38178 fixed and added to KEV.
- Sep 10, 2024 — CVE-2024-43461 fixed; CISA adds it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43461) on Sep 16.
- Oct 8, 2024 — CVE-2024-43573 fixed and added to KEV.
- Oct 16, 2024 — AhnLab and NCSC publish their APT37 report.
- Nov 12, 2024 — CVE-2024-43451 fixed and added to KEV.

## Sources

1. [Microsoft MSRC — CVE-2024-30040 Windows MSHTML Platform Security Feature Bypass Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040)
2. [Microsoft MSRC — CVE-2024-38112 Windows MSHTML Platform Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112)
3. [Microsoft MSRC — CVE-2024-43461 Windows MSHTML Platform Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461)
4. [Microsoft MSRC — CVE-2024-38178 Scripting Engine Memory Corruption Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178)
5. [Microsoft MSRC — CVE-2024-43573 Windows MSHTML Platform Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573)
6. [Microsoft MSRC — CVE-2024-43451 NTLM Hash Disclosure Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451)
7. [Microsoft MSRC — November 2024 Security Updates (CVRF)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov)
8. [CVE record — CVE-2024-43461](https://www.cve.org/CVERecord?id=CVE-2024-43461)
9. [CISA — Known Exploited Vulnerabilities: CVE-2024-43461](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43461)
10. [Check Point Research — Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)](https://research.checkpoint.com/2024/resurrecting-internet-explorer-threat-actors-using-zero-day-tricks-in-internet-shortcut-file-to-lure-victims-cve-2024-38112/)
11. [Trend Micro — CVE-2024-38112: Void Banshee Targets Windows Users Through Zero-Day](https://www.trendmicro.com/en_us/research/24/g/CVE-2024-38112-void-banshee.html)
12. [Zero Day Initiative — ZDI-24-1207: Microsoft Windows Internet Explorer File Extension Spoofing Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-24-1207/)
13. [AhnLab ASEC — AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178)](https://asec.ahnlab.com/en/83877/)
14. [Microsoft Learn — Microsoft Edge policy InternetExplorerIntegrationLevel](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/internetexplorerintegrationlevel)
15. [Tenable — Microsoft's October 2024 Patch Tuesday Addresses 117 CVEs (CVE-2024-43572, CVE-2024-43573)](https://www.tenable.com/blog/microsoft-october-2024-patch-tuesday-addresses-117-cves-cve-2024-43572-cve-2024-43573)
16. [BleepingComputer — Windows vulnerability abused braille spaces in zero-day attacks](https://www.bleepingcomputer.com/news/security/windows-vulnerability-abused-braille-spaces-in-zero-day-attacks/)
17. [SecurityWeek — Windows Zero-Day Exploited by Russia Triggered With File Drag-and-Drop, Delete Actions](https://www.securityweek.com/windows-zero-day-exploited-by-russia-triggered-with-file-drag-and-drop-delete-actions/)

---
Source page: https://erroneo.us/security/briefs/windows-mshtml-ie-mode-zero-days-cve-2024-38112/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt