Use-after-free RCE in Microsoft Internet Explorer mshtml.dll SetMouseCapture

Successful exploitation allows remote code execution on the target system. Because the vulnerability is reachable through malicious web content, an attacker can execute arbitrary code in the security context of the current user, enabling malware installation, data theft, persistence, and further compromise depending on the victim’s privileges. The content also notes that the vulnerability has been actively exploited in the wild, including in Operation DeputyDog.

Until patching is complete, reduce exposure by disabling or restricting Internet Explorer use, especially for untrusted web content; limit access to attacker-controlled or untrusted sites; and use least-privilege accounts to reduce post-exploitation impact. Additional compensating controls include application control, browser isolation, and monitoring for suspicious exploitation patterns involving crafted JavaScript, ms-help URLs, or abnormal loading of hxds.dll from Internet Explorer.

Apply the relevant Microsoft security update that addresses CVE-2013-3893 for Internet Explorer 6 through 11. Organizations should ensure unsupported Internet Explorer versions are retired and that all affected Windows systems receive vendor patches. CISA has added this CVE to the Known Exploited Vulnerabilities catalog, so affected environments should prioritize remediation on exposed and user-facing systems.