CVE-2012-4969

Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet...

8.1 HighIn KEVPublic exploit

CVE-2012-4969 is a high vulnerability (CVSS 8.1) in Microsoft Internet Explorer, published September 18, 2012. CISA lists it as known to be exploited, since June 8, 2022. EUVD reports exploitation since June 8, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 80.2%, the 99th percentile. No source names a fixed version.

Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

80.2%Down 11.3 points since Feb 4, 2022

What each source reports

NVD Score used 8.1

Record: CVE-2012-4969
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-416
Updated: 2026-11-02

CVE List 8.1

Record: CVE-2012-4969
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2012-4893 8.1

Record: EUVD-2012-4893
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xvh2-pw6x-f8hh 8.1

Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet...

Record: GHSA-xvh2-pw6x-f8hh
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CISA KEV No score

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.

Record: CVE-2012-4969
Updated: 2026-11-02

Affected products

microsoft internet explorer

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	MS12-063 Microsoft Internet Explorer execCommand Use-After-Free Vulnerability	2012-09-14
Exploit-DB	Microsoft Internet Explorer - execCommand Use-After-Free (MS12-063) (Metasploit)	2012-10-10

History

History
When	Changed	Sources
2026-11-03	exploitation, exploits
2026-11-02	created	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD

References

Show 8 moreShow less