CVE-2021-26411 Microsoft Internet Explorer Memory Corruption

Exploited in the wild High 8.8 Published 11 Mar 2021 Updated 1 Oct 2026

Attackers can exploit a use-after-free flaw in Internet Explorer to execute arbitrary code, requiring users to apply vendor patches.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-26411?

CVE-2021-26411 is a high-severity use after free vulnerability in Microsoft Edge, published on 11 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Internet Explorer Memory Corruption Vulnerability

Weakness: CWE-416

Which versions are affected by CVE-2021-26411?

It affects 2 products.

Products include Microsoft Edge, Microsoft Internet Explorer.

How do I fix CVE-2021-26411?

No fix has been published for CVE-2021-26411 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-26411 being exploited?

Yes. Attackers have exploited CVE-2021-26411 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 proofs of concept on GitHub.

All Microsoft Edge vulnerabilities

Sources

Also known as GHSA-c5rh-mmr6-c7ch.