{"id":"CVE-2024-38112","published":"2024-07-09T17:15:47Z","modified":"2026-06-17T07:39:26Z","title":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows MSHTML Platform Spoofing Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The MSHTML Platform component of Microsoft Windows contains a spoofing flaw that lets it misrepresent critical information in its user interface. An attacker can exploit this remotely without authentication, but only if a user is induced to interact with crafted content and the attack is hard to carry out reliably, which is why it is classed as high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:15Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.84225,"percentile":0.99695,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-07-09","dueDate":"2024-07-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112; https://nvd.nist.gov/vuln/detail/CVE-2024-38112","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-07-09","exploitedFirstSeen":"2024-07-09","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Jul","date":"2024-07-09"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112","date":"2024-07-09"},{"url":"https://research.checkpoint.com/2024/resurrecting-internet-explorer-threat-actors-using-zero-day-tricks-in-internet-shortcut-file-to-lure-victims-cve-2024-38112/","date":"2024-07-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-07-09"},{"url":"https://www.trendmicro.com/en_us/research/24/g/CVE-2024-38112-void-banshee.html","date":"2024-07-15"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/08/06/2024-midyear-threat-landscape-review","date":"2024-08-06"},{"url":"https://redalert.nshc.net/2024/08/29/monthly-threat-actor-group-intelligence-report-july-2024-kor/","date":"2024-08-29"},{"url":"https://www.tenable.com/blog/microsoft-october-2024-patch-tuesday-addresses-117-cves-cve-2024-43572-cve-2024-43573","date":"2024-10-08"},{"url":"https://redalert.nshc.net/2024/10/10/monthly-threat-actor-group-intelligence-report-july-2024-eng/","date":"2024-10-10"},{"url":"https://redalert.nshc.net/2024/10/29/monthly-threat-actor-group-intelligence-report-july-2024-jpn/","date":"2024-10-29"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-451","name":"User Interface (UI) Misrepresentation of Critical Information"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112","tags":["Patch","Vendor Advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38112","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Spoofing Vulnerability","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system.","confidence":"high"},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Spoofing Vulnerability","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-37791","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37791","exploited":true,"exploitedSince":"2024-07-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-07-25","earliestUrl":"https://github.com/BunBunCodes/CPSC253_CybersecurityFinalProjectReports","repos":[{"name":"BunBunCodes/CPSC253_CybersecurityFinalProjectReports","url":"https://github.com/BunBunCodes/CPSC253_CybersecurityFinalProjectReports","stars":0,"created":"2025-07-25"}]},"first":{"date":"2025-07-25","source":"PoC-in-GitHub","url":"https://github.com/BunBunCodes/CPSC253_CybersecurityFinalProjectReports"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189","T1204.001"],"provenance":"source"}],"timeline":[{"date":"2024-07-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38112","provenance":"source"},{"date":"2024-07-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Jul","provenance":"source"},{"date":"2024-07-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-07-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37791","provenance":"source"},{"date":"2025-07-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/BunBunCodes/CPSC253_CybersecurityFinalProjectReports","provenance":"source"}],"speed":{"daysToPublicExploit":381,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 843 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}