CVE-2008-4844: Microsoft Internet Explorer mshtml.dll Use-After-Free RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with in-the-wild exploitation and a very high EPSS score, but the affected product is legacy and a patch has long been available.

What it is

A use-after-free flaw in the CRecordInstance::TransferToDestination function in mshtml.dll lets a crafted HTML or XML document corrupt memory during DSO binding handling. Because Internet Explorer 5.01, 6, 6 SP1 and 7 are affected and the bug was exploited in the wild in December 2008, it is a serious remote code execution issue for unpatched browsers.

Impact

An attacker can execute arbitrary code in the context of the logged-on user, giving full control of the affected system if the user has administrative rights. This can lead to installation of malware, data theft, or further network compromise.

Attack surface

The flaw is reached remotely over the network when a victim views a malicious HTML or XML page in Internet Explorer; no authentication is required, but user interaction (visiting the page or opening the document) is needed. The CVSS vector AV:N/AC:M/Au:N confirms network reachability with medium complexity and no authentication.

Exploitation

The record shows in-the-wild exploitation in December 2008 and reference tags for Exploit, with public exploit code in Exploit-DB; EPSS is 0.66513 (99.2nd percentile), though CISA KEV does not list it.

What to do

• Apply Microsoft security update MS08-078 immediately, which addresses this vulnerability.
• Upgrade to a supported Internet Explorer version or a modern browser that is not affected.
• Disable or restrict DSO/XML Island and Tabular Data Control behavior in Internet Explorer where feasible.
• Enforce network and email filtering to block known malicious HTML/XML content and exploit URLs.
• Limit user privileges so successful exploitation does not yield administrative rights.

Detection

• Monitor for Internet Explorer crashes or abnormal process terminations involving mshtml.dll.
• Inspect web proxy and IDS/IPS logs for known exploit URLs or patterns associated with this CVE.
• Hunt for suspicious child processes spawned by iexplore.exe, especially those making outbound connections.
• Review endpoint logs for memory corruption indicators or exploit artifacts in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.