Vulnerability record · CVE-2012-4969 · published 18 September 2012
CVE-2012-4969: Microsoft Internet Explorer mshtml.dll use-after-free in CMshtmlEd::Exec
Microsoft · Internet Explorer
A use-after-free flaw exists in the CMshtmlEd::Exec function in mshtml.dll in Internet Explorer 6 through 9. A crafted web page can trigger the freed object and corrupt memory, and the record states it was exploited in the wild in September 2012. It matters because IE was widely deployed and the flaw is remotely reachable through normal browsing.
Description
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution with no privileges or interaction required, confirmed in-the-wild exploitation and KEV listing, though the affected IE versions are long obsolete and largely retired.
What it is
A use-after-free flaw exists in the CMshtmlEd::Exec function in mshtml.dll in Internet Explorer 6 through 9. A crafted web page can trigger the freed object and corrupt memory, and the record states it was exploited in the wild in September 2012. It matters because IE was widely deployed and the flaw is remotely reachable through normal browsing.
Impact
An attacker can execute arbitrary code in the context of the affected browser process, giving full control of the user's session. The CVSS 3.1 vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network by a victim visiting a crafted web site; the CVSS vector shows no privileges required and no user interaction beyond loading the page. No authentication is needed.
Exploitation
Listed in CISA KEV since 2022-06-08, with a required action to apply vendor updates, and EPSS 30-day probability is 0.81716 (99.6th percentile). The description states it was exploited in the wild in September 2012, and references include Metasploit module and 0day write-ups.
What to do
- Apply the Microsoft security update referenced in the vendor advisory (Technet 2757760) and any superseding cumulative IE updates.
- Retire or block Internet Explorer 6 through 9; migrate users to a supported browser.
- Enforce Enhanced Mitigation Experience Toolkit or OS-level mitigations (DEP, ASLR, heap hardening) on any remaining IE hosts.
- Restrict or monitor outbound browsing from legacy systems and isolate them from sensitive network segments.
Detection
- Hunt for IE processes (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe or script hosts.
- Monitor for crashes in mshtml.dll and unusual heap corruption events on hosts running IE 6-9.
- Review web proxy and DNS logs for known exploit-hosting domains and for the Metasploit ie_execcommand_uaf module traffic patterns.
- Alert on KEV-listed CVE-2012-4969 exposure: any host still running IE 6-9 should be flagged for remediation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2012-4969 to the Known Exploited Vulnerabilities catalog on 8 June 2022 as "Microsoft Internet Explorer Use-After-Free Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 22 June 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-4969 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-4969), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
