---
title: "CVE-2012-4792: Microsoft Internet Explorer Use-After-Free Vulnerability"
url: https://erroneo.us/security/cve/CVE-2012-4792/
description: "CVE-2012-4792 (Microsoft Internet Explorer): Exploited in the wild (CISA KEV). Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8…"
type: vulnerability-record
section: "Security Digest"
date_published: 2012-12-30
date_modified: 2025-10-22
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2012-4792"
kev: true
cvss: 8.8
epss: 0.78823
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2012-4792: Microsoft Internet Explorer Use-After-Free Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Microsoft Internet Explorer. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2024-07-23, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2024-08-13 ; treat that as the outer limit, not the target.
- EPSS 78.8% , percentile 99.6: FIRST’s model estimates a 78.8% chance of exploitation activity in the next 30 days, higher than 99.6% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.

## What it is

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

## Affected products (CVE record)

- n/a n/a: see advisory

## Severity

- CISA-ADP CVSS 3.1: 8.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2024-07-23; federal due date 2024-08-13. Known ransomware use: Unknown.
- CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
- CISA SSVC assessment: exploitation active , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 78.82% probability of exploitation activity in the next 30 days; percentile 99.6.

## Sources

- [MS13-008](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008)
- [Listed in CISA KEV notes (learn.microsoft.com)](https://learn.microsoft.com/en-us/lifecycle/products/internet-explorer-11)
- [CVE.org record CVE-2012-4792](https://www.cve.org/CVERecord?id=CVE-2012-4792)
- [NVD entry CVE-2012-4792](https://nvd.nist.gov/vuln/detail/CVE-2012-4792)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792)
- [TA13-008A](http://www.us-cert.gov/cas/techalerts/TA13-008A.html)
- [VU#154201](http://www.kb.cert.org/vuls/id/154201)
- [github.com](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb)
- [labs.alienvault.com](http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/)
- [packetstormsecurity.com](http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.html)
- [eromang.zataz.com](http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/)
- [oval:org.mitre.oval:def:16361](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361)
- [TA13-015A](http://www.us-cert.gov/cas/techalerts/TA13-015A.html)
- [blog.fireeye.com](http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html)
- [blogs.technet.com](http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx)
- [technet.microsoft.com](http://technet.microsoft.com/security/advisory/2794220)
- [blogs.technet.com](http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx)

---
Source page: https://erroneo.us/security/cve/CVE-2012-4792/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt