CVE-2012-4792: Internet Explorer use-after-free enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote code execution with no privileges required, active in-the-wild exploitation, a public Metasploit module and CISA KEV listing make this a top-priority legacy risk.

What it is

Microsoft Internet Explorer 6 through 8 contains a use-after-free flaw where a crafted web page triggers access to an object that was not properly allocated or was deleted, demonstrated with a CDwnBindInfo object. Successful exploitation allows remote code execution in the context of the browsing user. The flaw was exploited in the wild in December 2012, including in a watering hole attack.

Impact

An attacker can execute arbitrary code on the victim's machine with the privileges of the logged-on user, leading to full system compromise if that user has administrative rights. No data confidentiality, integrity or availability protection remains once code runs.

Attack surface

Reached over the network via a crafted web site that the victim must visit; the CVSS vector shows no privileges required but user interaction required (UI:R), so the victim must browse to or be lured to the malicious page. No authentication is needed by the attacker.

Exploitation

Exploited in the wild in December 2012 and listed in CISA KEV (added 2024-07-23), with a public Metasploit module and EPSS probability of 0.787 (99.6th percentile), indicating active and reliable exploitation.

What to do

• Apply Microsoft security update MS13-008 (or the earlier Fix it) to affected Internet Explorer 6, 7 and 8 installations.
• Retire or disconnect Internet Explorer 6 through 8, which are end-of-life, as CISA KEV requires; migrate users to a supported browser.
• Enforce a modern browser as default and block or restrict legacy IE usage via policy where it cannot be removed.
• Keep EMET or equivalent exploit mitigations enabled on any remaining legacy IE hosts as a stopgap until removal.

Detection

• Hunt for IE 6/7/8 processes (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for a browser.
• Monitor for network connections from iexplore.exe to unusual external hosts, especially following visits to compromised or low-reputation sites.
• Review proxy and web logs for known watering hole domains and exploit delivery patterns tied to the December 2012 campaign.
• Alert on crashes or heap corruption in iexplore.exe consistent with use-after-free exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.