# CVE-2021-33742: Internet Explorer out-of-bounds write in MSHTML

MSHTML truncates innerHTML string size to 25 bits in CTreePos while TextData keeps full length, causing out-of-bounds write in CSpliceTreeEngine::RemoveSplice; exploited via malicious Office docs.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Internet Explorer
- Credited: Maddie Stone, Google Project Zero & Threat Analysis Group
- Disclosed: 2021-06-03
- CVE: CVE-2021-33742
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-33742.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-33742
- Tags: domain:browser impact:mass-exploit impact:rce kind:incident platform:project-zero sev:high tech:windows technique:fuzzing vuln:memory-corruption

**Target:** MSHTML (mshtml.dll) HTML tree splice engine
**Root cause:** CTreePos stores string size truncated to 25 bits (size&0x1FFFFFF) while TextData retains full length; allocation uses truncated size but wmemcpy_s increments index by full srcTextSz, so subsequent writes go out of bounds.
**Steps:**
1. Create an html element and set innerHTML to a string of length 40370176 (Array(40370176).toString()) to exceed 0x1FFFFFF.
2. Reset innerHTML to empty string to trigger CSpliceTreeEngine::RemoveSplice.
3. Observe allocation sized by truncated CTreePos length while wmemcpy_s receives full srcTextSz.
4. Index v190 is incremented by srcTextSz rather than bytes copied, causing OOB write at RemoveSplice+0xb1f.
**How found:** Text suggests likely found via fuzzing; notes a tight-timeout fuzzer might miss it since triggering takes a few seconds. Variant analysis angle: CTreePos truncates to 25 bits while TextData does not.
**Exploitation:** Malicious Office documents loaded web content in Internet Explorer, fingerprinted the device, then redirected users to an IE page hosting the exploit; likely chained with a sandbox escape (not collected).
**Insight:** When a struct packs flags into high bits of a length field, hunt for sibling objects storing the untruncated length; mismatched alloc-vs-copy sizes plus index increments by source length yield OOB writes.