CVE-2011-0992

What it actually does

Use-after-free in Mono allows access to member data in a resurrected MonoThread instance, enabling memory corruption that results in plugin crashes or disclosure of sensitive information.

Why it matters to the business

Attackers could disrupt web plugin functionality or expose confidential data in legacy environments still running vulnerable Mono or Moonlight versions, though prevalence is extremely low given the age and lack of known exploitation.

How an attack unfolds

An attacker delivers specially crafted content to a target using the Moonlight plugin, triggering resurrection of a MonoThread object so that freed member data can be read or abused to cause denial of service or leak information.

How to fix it

Upgrade to Moonlight 2.4.1 or later for the 2.x branch and 3.99.3 or later for the 3.x branch; remove or disable the Moonlight plugin where possible since the project is discontinued.

How to confirm the fix worked

Confirm installed Moonlight versions meet or exceed the fixed releases, scan for residual vulnerable binaries, and test crafted inputs that previously triggered the resurrection path.

Typical attack path

1. Serve malicious web content or Silverlight-compatible payload to a victim browser running the vulnerable Moonlight plugin
2. Trigger MonoThread resurrection through member data manipulation
3. Exploit the dangling reference to read freed memory or induce a crash

How to detect it

Review historical browser and web server logs for Moonlight plugin crashes or unusual Silverlight resource requests; search endpoint inventories for any lingering Mono or Moonlight binaries.

What your security team should do

• Immediately inventory and remove any remaining Moonlight installations
• Block legacy plugin execution via browser policies or endpoint controls
• Monitor EPSS and KEV status for any future changes despite the 2011 publication date