CVE-2024-38112: Microsoft Windows MSHTML Platform spoofing flaw enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityThe flaw is listed in CISA KEV with active exploitation, has a very high EPSS score, and affects a wide range of widely deployed Windows versions.

What it is

CVE-2024-38112 is a spoofing vulnerability in the Windows MSHTML platform affecting a broad range of Windows 10, Windows 11 and Windows Server releases. The record gives only a one-line description, so the precise spoofing mechanism is not detailed, but the CVSS vector indicates high confidentiality, integrity and availability impact, making it a serious client-side issue.

Impact

An attacker who convinces a user to open a crafted file or link can spoof content and achieve high impact to confidentiality, integrity and availability on the target system. The exact attacker gain beyond spoofing is not specified in the record.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) but requires user interaction (UI:R), so exploitation depends on a victim opening a malicious document, link or similar content. No authentication is needed on the attacker side.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2024-07-09 with a remediation due date of 2024-07-30, and EPSS shows a 30-day probability of about 0.84 (99.7th percentile), indicating active exploitation in the wild.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-38112 as soon as possible.
• Prioritize patching internet-facing and user-workstation Windows 10, Windows 11 and Windows Server systems, including older builds still in the affected product list.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product where no mitigation is available.
• Restrict user ability to open untrusted documents and links, and enforce email/web content filtering to reduce the user-interaction vector.
• Verify patch status across all listed Windows versions, including legacy Windows Server 2008 and 2012 systems that may be out of standard support.

Detection

• Hunt for processes loading or invoking MSHTML (mshtml.dll) in unexpected contexts, especially spawned from email clients, browsers or document readers.
• Monitor for suspicious child processes launched from Office, browser or archive-handling applications that could indicate a spoofed-content lure.
• Review endpoint and proxy logs for access to URLs or files matching known exploitation patterns around the July 2024 disclosure window.
• Check patch-management data for unpatched systems among the affected Windows 10, Windows 11 and Windows Server builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.