A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 11. There is sufficient time between the free and reuse for an attacker to control the contents of the freed memory and exploit the vulnerability.
Microsoft Internet Explorer 11
This was one of the first bugs where I attempted to do a proper analysis, and I
got some feedback from ZDI that explained what I got right and what I got
wrong. Basically, on x86, a 0x28 byte memory block is allocated in
MSHTML!CMarkup:: and when you execute
document.. This memory can be freed when you execute
document. in a
DOMNodeRemoved event handler. After that, you can
After getting the feedback from ZDI that helped me understand the root cause, I attempted to write an exploit that the issue could be controlled and may be exploitable. I did not keep track of whether my attempts where successful, so the below code may not actually function. However, it should give you an idea on how one might go about writing an exploit for this vulnerability.Sploit.