According to multiple security firms, the vulnerability was used by hackers to exploit Windows PCs whose owners visited the website of the Council on Foreign Relations (CFR), a non-partisan foreign policy think tank with offices in New York and Washington, D.C.
Other researchers claimed that attacks using the IE vulnerability started as early as Dec. 7, and alleged that Chinese hackers were responsible for the CFR website hack.
The vulnerability is a remote code execution vulnerability that exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. According to Microsoft, the vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
On completion of this investigation, Microsoft will provide a solution through its monthly security update release process, or an out-of-cycle security update.
Microsoft's engineers have also released a preliminary workaround that will protect affected IE customers until the update is ready.