Loading story…
Microsoft released security update KB2799329 under bulletin MS13-008 on January 14, 2013, to fix CVE-2012-4792, a publicly disclosed use-after-free vulnerability in Internet Explorer 6, 7, and 8. A specially crafted website could exploit improper handling of objects in memory to execute arbitrary code with the current user's privileges. The flaw was exploited in the wild in December 2012, with cited reports linking it to a watering-hole attack involving the Council on Foreign Relations. Microsoft confirmed targeted attacks against Internet Explorer 8; Internet Explorer 9 and 10 were unaffected.
Microsoft rated the vulnerability Critical on Windows clients and Moderate on Windows servers and recommended immediate installation of the update. Because MS13-008 was not cumulative, administrators were advised to install the preceding cumulative update, MS12-077, to avoid compatibility issues. Temporary protections included the MSHTML Shim/Fix it workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET); these mitigations did not replace the security update.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft published security bulletin MS13-008 and released update KB2799329 to correct Internet Explorer's handling of objects in memory, recommending immediate installation. The bulletin reported targeted attacks attempting to exploit Internet Explorer 8 and noted that Internet Explorer 9 and 10 were unaffected.
Microsoft announced a Fix it mitigation for Internet Explorer 6, 7, and 8. Microsoft identified the MSHTML Shim Workaround as a temporary measure to prevent exploitation of CVE-2012-4792.
The CVE record was published describing a use-after-free vulnerability that allows remote code execution through a crafted website. The flaw involves access to an improperly allocated or deleted object, demonstrated with a CDwnBindInfo object.
Microsoft published a blog post identifying a new vulnerability affecting Internet Explorer 8 users. The supplied reference list associates the disclosure with CVE-2012-4792.
Attackers exploited CVE-2012-4792, a use-after-free vulnerability affecting Internet Explorer 6 through 8, in December 2012. Referenced reports linked the vulnerability to a watering-hole attack involving the Council on Foreign Relations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
9 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourceblogs.technet.com
Open sourcetechnet.microsoft.com
Open sourcedocs.microsoft.com
Open sourcetechnet.microsoft.com
Open sourceweb.nvd.nist.gov
Open sourceblog.fireeye.com
Open sourceeromang.zataz.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released cumulative Internet Explorer security update **KB2925418 (MS14-012)** on March 11, 2014, addressing memory-corruption vulnerabilities that could allow remote code execution through specially crafted webpages. The fixes included **CVE-2014-0322**, a CMarkup use-after-free vulnerability affecting Internet Explorer 9 and 10 that was exploited in the wild in January and February 2014. FireEye reported an Internet Explorer zero-day in a watering-hole attack, and CERT/CC published a corresponding vulnerability advisory. Microsoft confirmed limited, targeted attacks against CVE-2014-0322 in Internet Explorer 10 and a separate flaw, **CVE-2014-0324**, in Internet Explorer 8. The cumulative update covered Internet Explorer 6 through 11, with Critical severity on affected Windows clients and generally Moderate severity on affected Windows servers. Successful exploitation gives attackers the current user's privileges, potentially enabling complete system compromise if the user has administrative rights. The update corrected how Internet Explorer handles objects in memory; restricted browser settings, least-privilege accounts, and EMET offered additional mitigations. A September 2014 bulletin revision added **CVE-2014-4112** to the documented vulnerabilities without requiring further action from customers who had already installed the update.
Oct 9, 2026
Microsoft released security bulletin **MS13-038** and update **KB2847204** on May 14, 2013, to address the publicly disclosed, actively exploited Internet Explorer use-after-free vulnerability **CVE-2013-1347**. Specially crafted web content could trigger remote code execution with the current user's privileges. Microsoft confirmed attacks targeting Internet Explorer 8 and rated the update Critical for affected Windows clients and Moderate for Windows servers. Internet Explorer 9 received a defense-in-depth update because its default configuration blocked known attack vectors. The patch corrects Internet Explorer's handling of objects in memory. Microsoft recommended immediate installation alongside cumulative update **MS13-037** to avoid compatibility issues. Temporary mitigations included the MSHTML Shim workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET). Microsoft's Windows Update Standalone Installer documentation provides supporting guidance for deploying standalone Windows update packages.
Oct 9, 2026
Microsoft released security bulletin **MS14-021 (KB2965111)** on May 1, 2014, to fix **CVE-2014-1776**, a use-after-free vulnerability affecting Internet Explorer 6 through 11. A specially crafted webpage could execute arbitrary code with the current user's privileges, potentially enabling complete system compromise if the user had administrative rights. Exploitation was observed in April 2014, with Microsoft reporting limited, targeted attacks and a referenced FireEye report identifying attacks against Internet Explorer 9 through 11. Microsoft rated the flaw Critical on affected Windows clients and Moderate on affected Windows servers; NIST's reference listing also links to CISA's Known Exploited Vulnerabilities Catalog. The update corrects Internet Explorer's handling of objects in memory, but is **not cumulative**: administrators must install applicable preceding cumulative updates and select the appropriate Internet Explorer 11 package based on installed prerequisites. Microsoft recommended immediate installation and documented interim mitigations including EMET 4.0 or 4.1, Enhanced Protected Mode with 64-bit processes, restricted browser security settings, and unregistering VGX.DLL. The vulnerable function is CMarkup::IsConnectedToPrimaryMarkup, not code within VGX.DLL; disabling that library blocks known exploit techniques rather than fixing the underlying vulnerability.
Oct 9, 2026