CVE-2012-1875: Internet Explorer 8 use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with a 9.3 CVSS score and very high EPSS probability, though no confirmed in-the-wild exploitation is recorded.

What it is

Microsoft Internet Explorer 8 mishandles objects in memory, letting a remote attacker trigger a use-after-free by accessing a deleted object, tracked as the "Same ID Property Remote Code Execution Vulnerability." Because the flaw corrupts memory in a widely deployed browser, it can lead to arbitrary code execution in the context of the logged-on user.

Impact

An attacker who successfully exploits the flaw gains arbitrary code execution with the privileges of the current user, which can mean full control of the affected system if that user has administrative rights.

Attack surface

Reached over the network by luring a user to a crafted web page that triggers the deleted-object access; no authentication is required, but user interaction (visiting the page) is needed, consistent with the AV:N/AC:M/Au:N vector.

Exploitation

Not listed in CISA KEV and no reference tags indicate known exploitation, but EPSS is high at 0.61655 (99.13th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply Microsoft security bulletin MS12-037, which addresses this vulnerability, as the primary fix.
• Upgrade or migrate users off Internet Explorer 8 to a supported browser where feasible.
• Enforce Protected Mode and other IE hardening settings, and restrict browsing to trusted sites.
• Limit user privileges so code execution does not run with administrative rights.

Detection

• Monitor for IE 8 processes spawning unexpected child processes such as cmd.exe or scripting hosts.
• Hunt for crashes or abnormal terminations of iexplore.exe tied to suspicious referrer URLs.
• Review proxy and web logs for access to known malicious or exploit-hosting pages targeting this flaw.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.