Exploit Published for New Internet Explorer Flaw
Summary: Microsoft warned that hackers published exploit code for a previously unknown flaw in all versions of Internet Explorer, which involves the way IE handles CSS style sheets. The Metasploit Project's exploit evades Address Space Layout Randomization and Data Execution Prevention on Windows Vista and Windows 7, and Microsoft said it is considering a security update while pointing users to the Enhanced Mitigation Experience Toolkit as an interim measure.
What's compelling: The exploit works because IE loads DLLs at run-time and Microsoft lets each DLL decide whether to support ASLR, so a DLL that opts out lands at a predictable address and defeats the protection. Microsoft said it is not aware of attacks using the flaw, but that public disclosure may increase the likelihood criminals will use it against customers.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026