Loading story…
Security research showed that Microsoft XMLDOM DTD validation in Internet Explorer could be abused to disclose limited client-side information through distinguishable error messages. By supplying external-entity-style references using formats such as UNC paths, file path variants, direct drive-letter paths, NTFS alternate data streams, and the res:// protocol, an attacker could infer whether local files, folders, drive letters, network shares, and some local hosts existed on the victim system.
The reported behavior did not provide reliable arbitrary file-content disclosure, but it enabled existence checks and some local network probing based on error differences and response timing. Proof-of-concept pages were published to demonstrate the issue, and the researcher also noted that XMLDOM's DTD parsing behavior appeared susceptible to denial of service, characterizing the overall finding as a low-impact, Internet Explorer client-side information disclosure issue.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The researcher published proof-of-concept pages showing how UNC paths, file path variants, NTFS alternate data streams, direct drive references, and the res:// protocol could be used to trigger informative errors in IE XMLDOM. The write-up also noted apparent denial-of-service behavior related to DTD parsing.
Security research found that Microsoft XMLDOM DTD validation in Internet Explorer returned distinguishable error messages for different path types, allowing limited inference about the existence of local files, folders, drive letters, network shares, and some local hosts. The issue was characterized as a low-impact, client-side information disclosure rather than arbitrary file read.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers published a detailed patch analysis and proof-of-concept exploit for **CVE-2016-0189**, a VBScript engine memory corruption flaw in **Internet Explorer 11** that had already been used in targeted attacks in South Korea. The analysis of Microsoft bulletin **MS16-051** found two patched issues in `vbscript.dll`: a missing `SafeArray` lock in the `AccessArray` function that can enable out-of-bounds read/write during array resizing, and an `IsUnsafeAllowed` logic flaw that bypasses VBScript safety checks. Chaining the bugs allows arbitrary memory read/write and modification of `COleScript` safety settings to enable unsafe script execution in IE11 on Windows 10. The accompanying GitHub repository released a public exploit for Windows 10 and IE11, lowering the barrier to reproducing the attack path. The researchers noted the exploit was not fully reliable and might require repeated page loads, but showed how the vulnerability could still be leveraged despite Internet Explorer Protected Mode. Their write-up also described using a localhost/Intranet trust-based technique, previously documented by Zero Day Initiative, to move from a Protected Mode context toward **Medium integrity** code execution.
Jul 24, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026Security research and public tooling continue to highlight **Microsoft IIS short file name disclosure**, a long-standing issue in which IIS reveals whether files or directories exist by exposing Windows `8.3` short-name behavior through differential HTTP responses. Research published over several years shows the issue can be triggered with the tilde (`~`) character and remains observable across multiple IIS generations, including newer versions where detection can be performed with the `OPTIONS` method rather than `GET`. The disclosures also noted a related **.NET Framework tilde-character denial-of-service** condition, while emphasizing that the IIS issue is primarily an information leak that can still materially aid attackers by identifying sensitive files, admin paths, and application structure. Later work expanded the practical impact by documenting improved enumeration techniques, edge cases involving **HTTP.SYS**, **Kestrel**, WAFs, and virtual paths, and methods to distinguish IIS applications, directories, and virtual directories. Researchers also described a way to recover full long file names in some cases when names contain a tilde followed by a digit, extending the value of the leak beyond basic short-name discovery. Open-source tools such as **sns** and **IISRecon** have operationalized the technique, allowing defenders and attackers alike to scan exposed IIS servers and brute-force likely paths once short names are identified.
Jun 29, 2026