CVE-2012-4792

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers...

8.8 HighIn KEVPublic exploit

CVE-2012-4792 is a high vulnerability (CVSS 8.8) in Microsoft Internet Explorer, published December 30, 2012. CISA lists it as known to be exploited, since July 23, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 78.8%, the 99th percentile. No source names a fixed version.

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

78.8%Down 16.5 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2012-4792
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-416
Updated: 2026-11-02

CVE List 8.8

Record: CVE-2012-4792
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2012-4717 8.8

Record: EUVD-2012-4717
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-c5c8-vqpp-hm75 8.8

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers...

Record: GHSA-c5c8-vqpp-hm75
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CISA KEV No score

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.

Record: CVE-2012-4792
Weakness: CWE-416
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft Internet Explorer - CDwnBindInfo Object Use-After-Free (Metasploit)	2012-12-31
Exploit-DB	Microsoft Internet Explorer - CButton Object Use-After-Free (Metasploit)	2013-01-02
Metasploit	MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability	2012-12-27
PoC in GitHub	WizardVan/CVE-2012-4792	2015-05-03

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

References

Show 10 moreShow less