CVE-2024-38112

CVE-2024-38112 is a significant vulnerability discovered in the MSHTML (Trident) engine, which was primarily used for the now retired Internet Explorer browser. Despite the retirement of IE, this vulnerability also impacts newer Windows 10 and Windows 11 systems, where Edge is the default browser. The flaw stems from a weakness in the software's design or implementation, making these systems susceptible to attacks exploiting this vulnerability. The Advanced Persistent Threat (APT) group, known as Void Banshee, leveraged this vulnerability to target victims across North America, Europe, and Southeast Asia, according to a blog post published by Trend Micro on July 15. This revelation shed new light on the extent of the threat posed by CVE-2024-38112 and how it had been exploited in real-world cyberattacks. The disclosure of the exploit prompted immediate action from both Microsoft and cybersecurity experts. In response to this security concern, Microsoft released an official patch for CVE-2024-38112 on July 9, prior to the public disclosure by Trend Micro. Since then, Microsoft and Trend Micro have been working collaboratively to mitigate the effects of this vulnerability. Users of affected systems are strongly advised to apply this patch promptly to protect their systems from potential attacks exploiting this flaw.