Loading story…
Microsoft released cumulative Internet Explorer security update KB2925418 (MS14-012) on March 11, 2014, addressing memory-corruption vulnerabilities that could allow remote code execution through specially crafted webpages. The fixes included CVE-2014-0322, a CMarkup use-after-free vulnerability affecting Internet Explorer 9 and 10 that was exploited in the wild in January and February 2014. FireEye reported an Internet Explorer zero-day in a watering-hole attack, and CERT/CC published a corresponding vulnerability advisory. Microsoft confirmed limited, targeted attacks against CVE-2014-0322 in Internet Explorer 10 and a separate flaw, CVE-2014-0324, in Internet Explorer 8.
The cumulative update covered Internet Explorer 6 through 11, with Critical severity on affected Windows clients and generally Moderate severity on affected Windows servers. Successful exploitation gives attackers the current user's privileges, potentially enabling complete system compromise if the user has administrative rights. The update corrected how Internet Explorer handles objects in memory; restricted browser settings, least-privilege accounts, and EMET offered additional mitigations. A September 2014 bulletin revision added CVE-2014-4112 to the documented vulnerabilities without requiring further action from customers who had already installed the update.
See which actors are running it and whether you're in range.
23 events from the most recent confirmed update back to the earliest known activity.
The CVE-2014-4112 record was published, documenting an Internet Explorer 11 memory corruption vulnerability that could allow arbitrary code execution or denial of service through a crafted website. The record references MS14-012 and identifies the flaw as distinct from CVE-2014-0304.
Microsoft revised MS14-012 to version 1.1, adding CVE-2014-4112 to the documented vulnerabilities. Microsoft characterized the change as informational and said customers who had successfully installed KB2925418 needed no further action.
The CVE-2014-0305 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 6 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0298 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 9 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0303 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 6 through 8 that could allow arbitrary code execution or denial of service through a crafted website. The record references MS14-012 and identifies the flaw as distinct from CVE-2014-0302.
The CVE-2014-0308 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 8 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0306 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 8 and 9. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0321 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 10 and 11 that could allow arbitrary code execution or denial of service through a crafted website. The record references Microsoft bulletin MS14-012 and distinguishes the flaw from CVE-2014-0313.
The CVE-2014-0311 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 6 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0313 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 10 and 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references MS14-012 and distinguishes the flaw from CVE-2014-0321.
The CVE-2014-0304 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0302 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 6 through 8. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0307 record was published, documenting a use-after-free vulnerability in Internet Explorer 9 involving TextRange element manipulations. Remote attackers could execute arbitrary code or cause denial of service through memory corruption; the record references Microsoft bulletin MS14-012 and Exploit-DB entry 32438.
The CVE-2014-0297 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 8 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0324 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 8 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0309 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 8 through 10. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0312 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 8 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0314 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 9 and 10. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
The CVE-2014-0299 record was published, documenting a memory corruption vulnerability affecting Internet Explorer 6 through 11. A crafted website could allow remote attackers to execute arbitrary code or cause denial of service; the record references Microsoft bulletin MS14-012.
Microsoft released cumulative update KB2925418 under bulletin MS14-012 to correct memory-handling vulnerabilities in Internet Explorer 6 through 11, including CVE-2014-0322 and CVE-2014-0324. The update addressed flaws that could permit remote code execution when users viewed specially crafted webpages.
The CVE record for CVE-2014-0322 was published, documenting a remotely exploitable use-after-free vulnerability affecting Internet Explorer 9 and 10.
Attackers exploited CVE-2014-0322 in January and February 2014. The use-after-free vulnerability in Internet Explorer 9 and 10 allows remote code execution through crafted JavaScript involving CMarkup and a script element's onpropertychange attribute.
Microsoft reported limited, targeted attacks attempting to exploit CVE-2014-0324 in Internet Explorer 8. The vulnerability was marked as not publicly disclosed in the security bulletin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
24 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcetechnet.microsoft.com
Open sourcedocs.microsoft.com
Open sourcekb.cert.org
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security update **KB2799329** under bulletin **MS13-008** on January 14, 2013, to fix **CVE-2012-4792**, a publicly disclosed use-after-free vulnerability in Internet Explorer 6, 7, and 8. A specially crafted website could exploit improper handling of objects in memory to execute arbitrary code with the current user's privileges. The flaw was exploited in the wild in December 2012, with cited reports linking it to a watering-hole attack involving the Council on Foreign Relations. Microsoft confirmed targeted attacks against Internet Explorer 8; Internet Explorer 9 and 10 were unaffected. Microsoft rated the vulnerability **Critical** on Windows clients and **Moderate** on Windows servers and recommended immediate installation of the update. Because MS13-008 was not cumulative, administrators were advised to install the preceding cumulative update, **MS12-077**, to avoid compatibility issues. Temporary protections included the MSHTML Shim/Fix it workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET); these mitigations did not replace the security update.
Oct 9, 2026
Microsoft released security bulletin **MS14-021 (KB2965111)** on May 1, 2014, to fix **CVE-2014-1776**, a use-after-free vulnerability affecting Internet Explorer 6 through 11. A specially crafted webpage could execute arbitrary code with the current user's privileges, potentially enabling complete system compromise if the user had administrative rights. Exploitation was observed in April 2014, with Microsoft reporting limited, targeted attacks and a referenced FireEye report identifying attacks against Internet Explorer 9 through 11. Microsoft rated the flaw Critical on affected Windows clients and Moderate on affected Windows servers; NIST's reference listing also links to CISA's Known Exploited Vulnerabilities Catalog. The update corrects Internet Explorer's handling of objects in memory, but is **not cumulative**: administrators must install applicable preceding cumulative updates and select the appropriate Internet Explorer 11 package based on installed prerequisites. Microsoft recommended immediate installation and documented interim mitigations including EMET 4.0 or 4.1, Enhanced Protected Mode with 64-bit processes, restricted browser security settings, and unregistering VGX.DLL. The vulnerable function is CMarkup::IsConnectedToPrimaryMarkup, not code within VGX.DLL; disabling that library blocks known exploit techniques rather than fixing the underlying vulnerability.
Oct 9, 2026
Microsoft released security bulletin **MS13-038** and update **KB2847204** on May 14, 2013, to address the publicly disclosed, actively exploited Internet Explorer use-after-free vulnerability **CVE-2013-1347**. Specially crafted web content could trigger remote code execution with the current user's privileges. Microsoft confirmed attacks targeting Internet Explorer 8 and rated the update Critical for affected Windows clients and Moderate for Windows servers. Internet Explorer 9 received a defense-in-depth update because its default configuration blocked known attack vectors. The patch corrects Internet Explorer's handling of objects in memory. Microsoft recommended immediate installation alongside cumulative update **MS13-037** to avoid compatibility issues. Temporary mitigations included the MSHTML Shim workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET). Microsoft's Windows Update Standalone Installer documentation provides supporting guidance for deploying standalone Windows update packages.
Oct 9, 2026