Actively exploited in the wild
Microsoft Windows MSHTML Platform Spoofing Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2024-09-16. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-43461
HighCVSS 8.8KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
A spoofing vulnerability in the Windows MSHTML platform.
Risk Assessment
An attacker could exploit this to impersonate trusted content or applications, potentially leading to phishing or malware infection.
Recommendation
Apply the security update released by Microsoft for this vulnerability.
Other vulnerabilities in Windows MSHTML
See all- CVE-2023-32046HighActively exploited
Windows MSHTML Platform Elevation of Privilege Vulnerability. Technical details are not provided in the description.
- CVE-2021-34534Medium
Remote code execution vulnerability in Windows MSHTML platform. An attacker could exploit this flaw to run arbitrary code in the context of the logged-on user.
- CVE-2021-34447Medium
A remote code execution vulnerability in the Windows MSHTML platform allows an attacker to execute arbitrary code in the context of the logged-on user. The attack can be carried out via a specially crafted web page or document.
- CVE-2021-34497Medium
Remote code execution vulnerability in Windows MSHTML platform. An attacker could exploit this flaw to run arbitrary code in the context of the logged-on user.
Original NVD description (English source)
Windows MSHTML Platform Spoofing Vulnerability