Loading story…
Microsoft released security bulletin MS13-038 and update KB2847204 on May 14, 2013, to address the publicly disclosed, actively exploited Internet Explorer use-after-free vulnerability CVE-2013-1347. Specially crafted web content could trigger remote code execution with the current user's privileges. Microsoft confirmed attacks targeting Internet Explorer 8 and rated the update Critical for affected Windows clients and Moderate for Windows servers. Internet Explorer 9 received a defense-in-depth update because its default configuration blocked known attack vectors.
The patch corrects Internet Explorer's handling of objects in memory. Microsoft recommended immediate installation alongside cumulative update MS13-037 to avoid compatibility issues. Temporary mitigations included the MSHTML Shim workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET). Microsoft's Windows Update Standalone Installer documentation provides supporting guidance for deploying standalone Windows update packages.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published MS13-038 and released KB2847204, correcting Internet Explorer's handling of objects in memory. Microsoft confirmed awareness of attacks attempting to exploit Internet Explorer 8 and recommended immediate installation alongside cumulative update MS13-037.
Microsoft provided an automated Fix it solution implementing the MSHTML Shim workaround to prevent exploitation through known attack vectors. Customers who applied it could leave it installed while deploying the subsequent security update.
Microsoft first described the publicly disclosed vulnerability CVE-2013-1347 in Security Advisory 2847140. The use-after-free flaw could allow arbitrary code execution with the current Internet Explorer user's privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcetechnet.microsoft.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security bulletin **MS14-021 (KB2965111)** on May 1, 2014, to fix **CVE-2014-1776**, a use-after-free vulnerability affecting Internet Explorer 6 through 11. A specially crafted webpage could execute arbitrary code with the current user's privileges, potentially enabling complete system compromise if the user had administrative rights. Exploitation was observed in April 2014, with Microsoft reporting limited, targeted attacks and a referenced FireEye report identifying attacks against Internet Explorer 9 through 11. Microsoft rated the flaw Critical on affected Windows clients and Moderate on affected Windows servers; NIST's reference listing also links to CISA's Known Exploited Vulnerabilities Catalog. The update corrects Internet Explorer's handling of objects in memory, but is **not cumulative**: administrators must install applicable preceding cumulative updates and select the appropriate Internet Explorer 11 package based on installed prerequisites. Microsoft recommended immediate installation and documented interim mitigations including EMET 4.0 or 4.1, Enhanced Protected Mode with 64-bit processes, restricted browser security settings, and unregistering VGX.DLL. The vulnerable function is CMarkup::IsConnectedToPrimaryMarkup, not code within VGX.DLL; disabling that library blocks known exploit techniques rather than fixing the underlying vulnerability.
Oct 9, 2026
Microsoft released security update **KB2799329** under bulletin **MS13-008** on January 14, 2013, to fix **CVE-2012-4792**, a publicly disclosed use-after-free vulnerability in Internet Explorer 6, 7, and 8. A specially crafted website could exploit improper handling of objects in memory to execute arbitrary code with the current user's privileges. The flaw was exploited in the wild in December 2012, with cited reports linking it to a watering-hole attack involving the Council on Foreign Relations. Microsoft confirmed targeted attacks against Internet Explorer 8; Internet Explorer 9 and 10 were unaffected. Microsoft rated the vulnerability **Critical** on Windows clients and **Moderate** on Windows servers and recommended immediate installation of the update. Because MS13-008 was not cumulative, administrators were advised to install the preceding cumulative update, **MS12-077**, to avoid compatibility issues. Temporary protections included the MSHTML Shim/Fix it workaround, scripting restrictions, Internet Explorer Enhanced Security Configuration, and the Enhanced Mitigation Experience Toolkit (EMET); these mitigations did not replace the security update.
Oct 9, 2026
Microsoft released cumulative Internet Explorer security update **KB2925418 (MS14-012)** on March 11, 2014, addressing memory-corruption vulnerabilities that could allow remote code execution through specially crafted webpages. The fixes included **CVE-2014-0322**, a CMarkup use-after-free vulnerability affecting Internet Explorer 9 and 10 that was exploited in the wild in January and February 2014. FireEye reported an Internet Explorer zero-day in a watering-hole attack, and CERT/CC published a corresponding vulnerability advisory. Microsoft confirmed limited, targeted attacks against CVE-2014-0322 in Internet Explorer 10 and a separate flaw, **CVE-2014-0324**, in Internet Explorer 8. The cumulative update covered Internet Explorer 6 through 11, with Critical severity on affected Windows clients and generally Moderate severity on affected Windows servers. Successful exploitation gives attackers the current user's privileges, potentially enabling complete system compromise if the user has administrative rights. The update corrected how Internet Explorer handles objects in memory; restricted browser settings, least-privilege accounts, and EMET offered additional mitigations. A September 2014 bulletin revision added **CVE-2014-4112** to the documented vulnerabilities without requiring further action from customers who had already installed the update.
Oct 9, 2026