Loading story…
Microsoft released security bulletin MS14-021 (KB2965111) on May 1, 2014, to fix CVE-2014-1776, a use-after-free vulnerability affecting Internet Explorer 6 through 11. A specially crafted webpage could execute arbitrary code with the current user's privileges, potentially enabling complete system compromise if the user had administrative rights. Exploitation was observed in April 2014, with Microsoft reporting limited, targeted attacks and a referenced FireEye report identifying attacks against Internet Explorer 9 through 11. Microsoft rated the flaw Critical on affected Windows clients and Moderate on affected Windows servers; NIST's reference listing also links to CISA's Known Exploited Vulnerabilities Catalog.
The update corrects Internet Explorer's handling of objects in memory, but is not cumulative: administrators must install applicable preceding cumulative updates and select the appropriate Internet Explorer 11 package based on installed prerequisites. Microsoft recommended immediate installation and documented interim mitigations including EMET 4.0 or 4.1, Enhanced Protected Mode with 64-bit processes, restricted browser security settings, and unregistering VGX.DLL. The vulnerable function is CMarkup::IsConnectedToPrimaryMarkup, not code within VGX.DLL; disabling that library blocks known exploit techniques rather than fixing the underlying vulnerability.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft revised the bulletin to clarify that the latest applicable cumulative Internet Explorer update must be installed before MS14-021. The bulletin warned that missing prerequisites could cause compatibility problems, including intermittent browser unresponsiveness.
Microsoft published MS14-021 (KB2965111), correcting Internet Explorer's handling of objects in memory, and recommended immediate installation. Microsoft confirmed awareness of limited, targeted attacks and warned that this non-cumulative fix required applicable preceding cumulative updates.
Microsoft updated Security Advisory 2963983 to clarify workarounds intended to help prevent exploitation of the Internet Explorer vulnerability CVE-2014-1776.
The CVE record was published for a use-after-free vulnerability in Internet Explorer 6 through 11. The flaw permits remote arbitrary code execution or denial of service through memory corruption.
CVE-2014-1776 was exploited in the wild in April 2014. The referenced FireEye report described targeted attacks against Internet Explorer 9 through 11, although the vulnerability affected versions 6 through 11.
Microsoft first described CVE-2014-1776 in Security Advisory 2963983 before releasing MS14-021. The supplied content does not specify the advisory's publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcevicarius.io
Open sourcedocs.microsoft.com
Open sourcetechnet.microsoft.com
Open sourcetechnet.microsoft.com
Open sourcesignalsec.com
Open sourceweb.nvd.nist.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released cumulative Internet Explorer security update **KB2925418 (MS14-012)** on March 11, 2014, addressing memory-corruption vulnerabilities that could allow remote code execution through specially crafted webpages. The fixes included **CVE-2014-0322**, a CMarkup use-after-free vulnerability affecting Internet Explorer 9 and 10 that was exploited in the wild in January and February 2014. FireEye reported an Internet Explorer zero-day in a watering-hole attack, and CERT/CC published a corresponding vulnerability advisory. Microsoft confirmed limited, targeted attacks against CVE-2014-0322 in Internet Explorer 10 and a separate flaw, **CVE-2014-0324**, in Internet Explorer 8. The cumulative update covered Internet Explorer 6 through 11, with Critical severity on affected Windows clients and generally Moderate severity on affected Windows servers. Successful exploitation gives attackers the current user's privileges, potentially enabling complete system compromise if the user has administrative rights. The update corrected how Internet Explorer handles objects in memory; restricted browser settings, least-privilege accounts, and EMET offered additional mitigations. A September 2014 bulletin revision added **CVE-2014-4112** to the documented vulnerabilities without requiring further action from customers who had already installed the update.
Oct 9, 2026
Microsoft released security bulletin **MS13-038** and update **KB2847204** on May 14, 2013, to address the publicly disclosed, actively exploited Internet Explorer use-after-free vulnerability **CVE-2013-1347**. Specially crafted web content could trigger remote code execution with the current user's privileges. Microsoft confirmed attacks targeting Internet Explorer 8 and rated the update Critical for affected Windows clients and Moderate for Windows servers. Internet Explorer 9 received a defense-in-depth update because its default configuration blocked known attack vectors. The patch corrects Internet Explorer's handling of objects in memory. Microsoft recommended immediate installation alongside cumulative update **MS13-037** to avoid compatibility issues. Temporary mitigations included the MSHTML Shim workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET). Microsoft's Windows Update Standalone Installer documentation provides supporting guidance for deploying standalone Windows update packages.
Oct 9, 2026
Microsoft released security update **KB2799329** under bulletin **MS13-008** on January 14, 2013, to fix **CVE-2012-4792**, a publicly disclosed use-after-free vulnerability in Internet Explorer 6, 7, and 8. A specially crafted website could exploit improper handling of objects in memory to execute arbitrary code with the current user's privileges. The flaw was exploited in the wild in December 2012, with cited reports linking it to a watering-hole attack involving the Council on Foreign Relations. Microsoft confirmed targeted attacks against Internet Explorer 8; Internet Explorer 9 and 10 were unaffected. Microsoft rated the vulnerability **Critical** on Windows clients and **Moderate** on Windows servers and recommended immediate installation of the update. Because MS13-008 was not cumulative, administrators were advised to install the preceding cumulative update, **MS12-077**, to avoid compatibility issues. Temporary protections included the MSHTML Shim/Fix it workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET); these mitigations did not replace the security update.
Oct 9, 2026