Krishnakant Patil

This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of `Doc` objects due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process. It may also lead to information disclosure or remote code execution through potential Use-After-Free or Out-of-Bounds Read vulnerabilities when handling certain JavaScripts, `Doc` objects, or AcroForms.

This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of `Doc` objects due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this, in conjunction with other issues, to execute arbitrary code in the context of the current process.

The issue is related to an information disclosure problem when Internet Explorer improperly handles objects in memory. This could allow a remote attacker to disclose protected information, potentially further compromising the user's system.