An information disclosure vulnerability exists in the way that Internet Explorer handles negotiation of certificates in a TLS session. An attacker who successfully exploited this vulnerability could hijack a mutually authenticated TLS connection between Internet Explorer and an arbitrary target server.