CVE-2012-4792

HighPublished

Microsoft Internet Explorer Use-After-Free Vulnerability

Published: Dec 30, 2012
Updated: Oct 22, 2025
Assigning CNA: microsoft
Evidence observed: Dec 31, 2012

Primary CVSS

8.8/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS probability estimate

78.8%

High · next 30 days

Percentile: 99.6%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free VulnerabilityModule
modules/exploits/windows/browser/ie_cbutton_uaf.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: fa174ade81b5Related tool
Declared conditions
- platform: Windows($.exploit_windows/browser/ie_cbutton_uaf.platform)
- verification: check_not_declared($.exploit_windows/browser/ie_cbutton_uaf.check)

CVE-2012-4792Exploit
CVE-2012-4792 simple calc exploitation
Microsoft Internet Explorer - CDwnBindInfo Object Use-After-Free (Metasploit)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.