CVE-2024-43461: Windows MSHTML Platform spoofing flaw enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with active exploitation and a high CVSS score, but requires user interaction and the record gives no confirmed pre-auth remote code execution detail.

What it is

CVE-2024-43461 is a spoofing vulnerability in the Windows MSHTML platform, the legacy rendering engine still reachable through Windows components. The CVSS vector rates it high severity with full confidentiality, integrity and availability impact, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is being used in the wild.

Impact

An attacker who convinces a user to open crafted content can spoof what the user sees and, per the CVSS impact ratings, gain high confidentiality, integrity and availability impact on the target. The record does not specify the exact end effect beyond spoofing and those impact metrics.

Attack surface

Reachable over the network (AV:N) with no privileges required (PR:N), but it needs user interaction (UI:R), meaning a victim must open or view attacker-controlled content that triggers the MSHTML platform. No authentication is needed on the attacker side.

Exploitation

CISA added it to KEV on 2024-09-16 with a remediation due date of 2024-10-07, and EPSS gives a 30-day probability of about 0.545 (98.9th percentile), indicating active exploitation. No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2024-43461 across all listed Windows client and server versions.
• Prioritize internet-facing and user-workstation systems, and meet the CISA KEV remediation deadline of 2024-10-07.
• Reduce exposure to the legacy MSHTML engine where business needs allow, and restrict untrusted web and document content.
• Verify patching through your vulnerability management tooling and confirm the MSHTML component is updated, not just the OS build.

Detection

• Hunt for processes loading mshtml.dll or related MSHTML components spawned from browsers, Office or email clients.
• Monitor for suspicious child processes and network connections originating from MSHTML hosting processes.
• Alert on exploitation indicators tied to CVE-2024-43461 in EDR and network telemetry, and review KEV-related advisories for updated signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.