Summary
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Vendor
- Microsoft
- Product
- Internet Explorer
- Added to KEV
- May 20, 2026
- Remediation due
- Jun 3, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-399
- EPSS
- 82.1% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References