This critical use-after-free vulnerability in Microsoft Internet Explorer allows remote code execution and is currently being actively exploited in the wild.

The flaw exists within the SetMouseCapture implementation in mshtml.dll. It allows an unauthenticated remote attacker to execute arbitrary code by enticing a user to visit a malicious site containing crafted JavaScript strings, which leverages an ms-help: URL to bypass security protections like ASLR.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code with the privileges of the logged-in user. Given the CVSS score of 9.5, this represents a critical risk that can lead to complete system compromise, data exfiltration, or the installation of persistent malware. The active use of this exploit in targeted attacks further escalates the business risk to organizational security and data integrity.

Immediate Action: Apply the security update provided in Microsoft Security Bulletin MS13-080 immediately to patch the vulnerable mshtml.dll component.

Proactive Monitoring: Monitor network traffic for anomalous requests directed at hxds.dll or unexpected interactions with ms-help: URI schemes that may indicate exploitation attempts.

Compensating Controls: Ensure that Enhanced Protected Mode is enabled in Internet Explorer and maintain updated endpoint protection software to detect known malicious exploit patterns.

Public Exploit Available: Yes, a Metasploit module and ExploitDB entries exist.

Due to the critical severity and confirmed active exploitation, immediate patching is mandatory for any remaining legacy systems running Internet Explorer. Organizations should prioritize the deployment of MS13-080 and perform a sweep of the environment to identify any remaining instances of this browser, as it is long past its end-of-life support status and represents a severe liability to the enterprise.