Executive brief
A critical vulnerability in Microsoft Internet Explorer allows attackers to take complete control of a computer if a user visits a malicious website. This flaw affects older versions of the browser that are largely no longer supported, posing a significant risk to organizations still using legacy systems. Successful exploitation could lead to the theft of sensitive data, installation of malware, or a total disruption of business operations.
Technical details
A use-after-free vulnerability exists in the SetMouseCapture implementation within mshtml.dll in Microsoft Internet Explorer versions 6 through 11. The flaw is triggered when the browser improperly handles objects in memory during resource management, specifically when processing crafted JavaScript strings. An attacker can exploit this by enticing a user to visit a specially crafted webpage, potentially using an ms-help: URL to trigger the loading of hxds.dll to bypass security mitigations. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the current user. This vulnerability has been observed in active, targeted attacks in the wild.
Affected products
- Microsoft Internet Explorer 6 through 11
Timeline
- 2013-09-17: advisory: Microsoft released initial workaround information
- 2013-10-08: patched: Microsoft released security bulletin MS13-080 to address the issue
- 2013-10-08: exploited: Confirmed active exploitation in limited, targeted attacks
- 2025-08-12: kev added: Added to CISA Known Exploited Vulnerabilities catalog