CVE-2024-43573

What it actually does

CVE-2024-43573 is a Windows MSHTML Platform flaw that can be triggered remotely when a user opens or previews attacker-controlled content. MSHTML is the legacy HTML rendering engine still present in supported Windows versions and used by multiple Windows components and compatibility modes. Successful exploitation can allow spoofing of trusted-looking content or origin information and can result in high-impact disclosure of sensitive information, such as credentials, tokens, local file references, or other data exposed through the rendered content context. The vulnerability requires user interaction but does not require attacker authentication or prior access.

Why it matters to the business

Because this issue affects widely deployed Windows desktop and server versions and is listed in CISA KEV as actively exploited in the wild, unpatched systems represent a realistic phishing, credential-theft, and initial-access risk. Exploitation can support compromise of user accounts, unauthorized access to business systems, and follow-on intrusion activity. The CISA remediation deadline was 2024-10-29, so remaining exposure should be treated as overdue and high priority even though the CVSS score is moderate.

How an attack unfolds

An attacker prepares malicious web or document-like content that invokes MSHTML behavior on a vulnerable Windows system. The attacker then delivers the lure through email, messaging, a malicious website, a compromised site, or a file share. When a user opens the content, previews it, or follows the link, MSHTML processes attacker-controlled markup or URL-handling logic. The flaw allows the attacker to spoof trusted presentation or context and obtain sensitive information from the user or system. The attacker can then use the disclosed information, commonly credentials or session-related data, to attempt account takeover, lateral movement, or further payload delivery. Exploitation has been observed in the wild, so defenders should assume public tradecraft exists even if a weaponized exploit is not visible in all environments.

How to fix it

Apply the Microsoft security updates that include the October 2024 fix for CVE-2024-43573, or any later cumulative update, to all affected Windows versions: Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2. Use Windows Update, Microsoft Update Catalog, WSUS, Configuration Manager, or equivalent patch management tooling to deploy the latest cumulative update for each supported OS branch. Prioritize internet-facing workstations, high-risk user groups, jump hosts, administrator workstations, and systems used to process email or web content. Where immediate patching is not possible, reduce exposure by restricting high-risk attachment types, disabling or tightly controlling legacy Internet Explorer/MSHTML-dependent workflows, blocking untrusted HTML/HTA/URL files from email and web downloads, enforcing phishing-resistant MFA, and limiting outbound authentication to untrusted destinations. Unsupported Windows versions should be upgraded or isolated because they may not receive complete protection.

How to confirm the fix worked

Confirm that each system has installed the October 2024 Windows cumulative security update or a later cumulative update applicable to its OS version. Validate through enterprise patch inventory, Windows Update history, Microsoft Defender Vulnerability Management, WSUS/Configuration Manager compliance reports, or direct host checks such as installed hotfix/package inventory. Verify that the MSHTML component is updated as part of the OS cumulative update and that systems have rebooted where required. Test exposure by reviewing whether untrusted HTML, HTA, URL, MHT/MHTML, and Office-delivered web content can still invoke legacy MSHTML handling unexpectedly. Confirm compensating controls are active, including email attachment filtering, Mark-of-the-Web enforcement, SmartScreen, EDR behavioral monitoring, and outbound SMB/NTLM restrictions to untrusted networks.

Typical attack path

1. Identify organizations or users likely to run affected Windows versions with unpatched October 2024 or earlier security updates.
2. Craft malicious content that causes Windows components using MSHTML to render attacker-controlled material in a misleading or trusted-looking context.
3. Deliver the lure through phishing email, attachment, malicious link, compromised website, or shared file location.
4. Convince the user to open the file, preview the content, or browse to the malicious location.
5. Abuse the MSHTML spoofing flaw to disclose sensitive information or mislead the user into exposing credentials or other secrets.
6. Use the obtained information for account access, persistence, lateral movement, or additional malware delivery.

How to detect it

Look for evidence that users opened suspicious web-like files or links shortly before credential misuse or unusual authentication activity. Relevant log sources include EDR process telemetry, Windows Security logs, PowerShell logs, Sysmon, email security gateway logs, proxy/DNS logs, browser history, Office and Outlook telemetry, Defender for Endpoint alerts, and identity-provider sign-in logs. Hunt for MSHTML or legacy browser component activity spawned by email clients, Office applications, archive tools, PDF readers, Teams/chat clients, or from Downloads, Temp, INetCache, and email attachment directories. Review network telemetry for outbound connections immediately after opening HTML/HTA/URL/MHT/MHTML content, especially to newly registered domains, direct IP addresses, URL shorteners, or external SMB/WebDAV endpoints. Investigate any suspicious credential prompts, NTLM authentication attempts to external hosts, or anomalous sign-ins after suspected lure interaction. Because Microsoft has not published stable CVE-specific exploit strings for all campaigns, detection should emphasize behavior: user-initiated rendering of untrusted content through MSHTML, unexpected legacy IE/MSHTML process chains, and follow-on credential or session abuse.

• mshtml.dll
• mshta.exe
• iexplore.exe
• mhtml:
• file://
• \\
• http://
• https://
• .hta
• .htm
• .html
• .mht
• .mhtml
• .url
• Content-Type: message/rfc822
• Content-Type: multipart/related
• INetCache
• AppData\Local\Microsoft\Windows\INetCache
• AppData\Local\Temp
• rundll32.exe
• regsvr32.exe
• outlook.exe -> mshta.exe
• winword.exe -> mshta.exe
• excel.exe -> mshta.exe
• powerpnt.exe -> mshta.exe
• msedge.exe --ie-mode-test
• Microsoft-Windows-SmbClient/Security

What your security team should do

• Treat this as an urgent remediation item because it is in CISA KEV, has active in-the-wild exploitation, and the KEV due date has passed.
• Deploy the October 2024 or later Windows cumulative security updates across all affected Windows client and server versions, prioritizing endpoints used for email, browsing, administration, and privileged access.
• Run an enterprise-wide compliance query to identify Windows 10, Windows 11, and Windows Server systems missing the relevant cumulative update or pending reboot.
• Harden phishing and content-delivery controls by blocking or quarantining unsolicited HTML, HTA, URL, MHT, MHTML, CHM, LNK, and script-bearing attachments where business processes allow.
• Monitor for unusual invocations of MSHTML-related processes and legacy browser components, especially from email clients, Office applications, archive utilities, temporary download directories, and user profile paths.
• Investigate recent credential-theft indicators, suspicious outbound authentication attempts, and anomalous sign-ins from users who may have opened suspicious links or attachments.
• Restrict outbound NTLM/SMB authentication to the internet and monitor for attempts to authenticate to unfamiliar external hosts.
• Ensure phishing-resistant MFA is enforced for privileged and remote-access accounts to reduce the impact of disclosed credentials.