CVE-2024-43573: Windows MSHTML platform spoofing flaw exploited in the wild

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited and in CISA KEV with a near-term remediation deadline, though it requires user interaction and has no availability impact.

What it is

CVE-2024-43573 is a spoofing vulnerability in the Windows MSHTML platform, the legacy rendering engine still reachable through Windows components. It is listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation has been observed, and it affects a broad set of Windows 10, Windows 11 and Windows Server releases.

Impact

An attacker can spoof content or the origin of a page rendered by MSHTML, which can be used to deceive users and facilitate credential theft or further compromise. The CVSS vector shows high confidentiality and integrity impact with no availability impact.

Attack surface

The vector is network reachable (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R), meaning a victim must open or interact with attacker-controlled content such as a link or document. No authentication is needed on the attacker side.

Exploitation

CVE-2024-43573 was added to CISA KEV on 2024-10-08 with a remediation due date of 2024-10-29, confirming known exploitation. EPSS gives a 30-day exploitation probability of about 0.46 (98.7th percentile), and the record does not document ransomware campaign use.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-43573 on all affected Windows 10, Windows 11 and Windows Server systems.
• Prioritize internet-facing and user-workstation systems, and meet the CISA KEV remediation deadline of 2024-10-29.
• If patching cannot be completed immediately, follow the vendor mitigation guidance or discontinue use of the affected product as CISA directs.
• Reduce exposure to legacy MSHTML rendering where feasible and restrict untrusted web and document content through existing browser and email controls.

Detection

• Hunt for processes loading mshtml.dll in unexpected contexts, especially Office applications and script hosts spawning browser or network activity.
• Monitor for outbound connections and document or link opens that immediately precede credential prompts or suspicious child processes.
• Review proxy and DNS logs for known malicious domains tied to MSHTML exploitation campaigns and alert on repeat hits from the same host.
• Track patch compliance for the affected Windows builds and alert on hosts still missing the October 2024 update.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.