EIP-2026-115674

PRE-CVE

Microsoft Internet Explorer 11 - 'CMarkup::DestroySplayTree' Use-After-Free

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-115674. PoCs published by Marcin Ressel.

AI-analyzed exploit summary This exploit targets a use-after-free vulnerability in Internet Explorer 11's MSHTML!CMarkup::DestroySplayTree. It manipulates DOM elements and triggers memory corruption to achieve remote code execution.

Description

Microsoft Internet Explorer 11 - 'CMarkup::DestroySplayTree' Use-After-Free

Exploits (1)

exploitdb WORKING POC

by Marcin Ressel · htmldoswindows

https://www.exploit-db.com/exploits/41957

View Code ZIP pw:eip

This exploit targets a use-after-free vulnerability in Internet Explorer 11's MSHTML!CMarkup::DestroySplayTree. It manipulates DOM elements and triggers memory corruption to achieve remote code execution.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Complex

Reliability

Racy

Target: Internet Explorer 11 (11.0.9600.18638)

No auth needed

Prerequisites: Victim must visit a malicious webpage using Internet Explorer 11

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026