CVE-2024-43573

Deeper analysis

CVE-2024-43573 is a spoofing vulnerability in the Windows MSHTML Platform, the component responsible for parsing and rendering HTML content across multiple Windows applications. It carries a CVSS 3.1 score of 6.5 and is associated with CWE-79, indicating cross-site scripting or content-spoofing behavior that can be triggered remotely.

An unauthenticated attacker can exploit the flaw over the network by serving specially crafted content that a user must interact with, such as opening a malicious webpage or document. Successful exploitation allows the attacker to spoof trusted content and obtain high-impact confidentiality access to information processed by the affected MSHTML instance.

Microsoft has issued an advisory detailing the vulnerability and corresponding security update, while CISA has added CVE-2024-43573 to its catalog of known exploited vulnerabilities, confirming active in-the-wild use and underscoring the urgency of applying the patch. The EPSS score has reached a peak of 0.1855, reflecting sustained exploitation interest following disclosure.