CVE-2012-4969
Microsoft Internet Explorer Use-After-Free Vulnerability
Published Sep 18, 2012 · updated Jun 16, 2026 · microsoft internet explorer
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 18, 2012 · Catalog
Detected
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
Jun 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 22, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
Required action
Apply updates per vendor instructions.
CISA due date Jun 22, 2022
Affected
- cpe microsoft/internet explorer6
- cpe microsoft/internet explorer7
- cpe microsoft/internet explorer8
- cpe microsoft/internet explorer9
- vendor Microsoft Internet Explorerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2012-4969
Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.
cisa.gov - CVE.orgVulnerability recordCVE-2012-4969
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2012-4969
30-day exploitation probability 80.3%
first.org - Exploit DatabasePublic exploit reference21840
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_windows/browser/ie_execcommand_uaf
Public module reference (good). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2012-4969
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
nvd.nist.gov