Loading vulnerability…
Microsoft MSHTML Remote Code Execution
CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine on Windows. Attackers can distribute specially crafted Microsoft Office documents that load externally linked MHTML/OLE content and invoke malicious ActiveX controls. Exploitation can abuse CAB archive path traversal to place an attacker-controlled payload and execute it. The documented attack requires a user to open the malicious document and executes code with that user's privileges. The vulnerability was exploited as a zero-day before Microsoft released security updates on September 14, 2021.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the affected Windows endpoint through arbitrary code execution in the victim user's security context. Administrative users expose the system to greater compromise than standard users. Observed exploitation has delivered information stealers, spyware, remote-control implants, and ransomware, enabling credential theft, surveillance, data exfiltration, and file encryption. The vulnerability does not itself establish elevated privileges beyond those of the affected user.
If you can’t patch tonight, do this now.
Keep internet-origin Office documents in Protected View or Application Guard for Office, which prevent the documented attack. Disable installation of new signed and unsigned ActiveX controls across Internet Explorer security zones for both 32-bit and 64-bit processes. Enable the Microsoft Defender attack surface reduction rule that blocks Office applications from creating child processes. Keep Microsoft Defender Antivirus and Defender for Endpoint current; detection build 1.349.22.0 or newer provides protection against known exploitation. Additional measures include disabling Windows Explorer previews for Word and RTF documents and using accounts without administrative privileges.
Patch, then assume compromise.
Install the applicable Microsoft Windows security updates released on September 14, 2021, or superseding updates that include the fix. Ensure that the selected update combination covers MSHTML: on Windows 8.1, Windows Server 2012, and Windows Server 2012 R2, install either the Monthly Rollup or both the Security Only and Internet Explorer Cumulative updates. On Windows 7, Windows Server 2008, and Windows Server 2008 R2, the Monthly Rollup includes the fix; Security Only deployments also require the applicable Internet Explorer Cumulative update.
11 exploits validated by Mallory's analysis. Hidden: 10 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
69 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.