CVE-2010-0806
Microsoft Internet Explorer Use-After-Free Vulnerability
Description
CVE-2010-0806, addressed by Microsoft bulletin MS10-018, is a high-severity use-after-free vulnerability in the Peer Objects component (iepeers.dll) of Microsoft Internet Explorer. By accessing an invalid pointer after an object has been deleted, a crafted web page can corrupt memory and let a remote attacker execute arbitrary code in the context of the user browsing the page. Known as the "Uninitialized Memory Corruption Vulnerability," it was exploited in the wild in March 2010. With a CVSS score of 8.8, an EPSS score of 87.3% (99.5th percentile), and a CISA KEV listing, CVE-2010-0806 remains dangerous — and because Internet Explorer is end-of-life, the recommended action is to discontinue its use.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 5.01; 6; 8; 7 |
References
- http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx(Broken Link)
- http://osvdb.org/62810(Broken Link)
- http://secunia.com/advisories/38860(Vendor Advisory)
- http://www.kb.cert.org/vuls/id/744549(Patch, US Government Resource)
- http://www.microsoft.com/technet/security/advisory/981374.mspx(Broken Link, Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/38615(Broken Link)
- http://www.us-cert.gov/cas/techalerts/TA10-068A.html(US Government Resource)
- http://www.us-cert.gov/cas/techalerts/TA10-089A.html(US Government Resource)
- http://www.vupen.com/english/advisories/2010/0567(Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/0744(Vendor Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018(Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56772(Third Party Advisory, VDB Entry)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446(Broken Link)
- https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806(US Government Resource)
Weakness Type
CWE-416: Use After Free
In Internet Explorer's Peer Objects component (iepeers.dll), the use-after-free occurs when the browser accesses an invalid pointer after the underlying object has been deleted. A crafted HTML page can manipulate object lifetimes so the freed memory is reused under attacker control, leading to memory corruption and arbitrary code execution.
Learn more: CWE-416 — Use After Free
CWE-399: Resource Management Errors
More broadly, the flaw is a resource management error: Internet Explorer mismanages the lifecycle of an in-memory object, freeing it while a dangling reference remains, which is the underlying mistake that the use-after-free exploits.
Learn more: CWE-399 — Resource Management Errors
Impact Analysis
CVE-2010-0806 carries a CVSS 3.1 score of 8.8 (HIGH). It is remotely exploitable over the network with low attack complexity and requires no privileges, but it does require user interaction — the victim must visit a malicious or compromised web page — and on success it fully compromises the confidentiality, integrity, and availability of the system in the user's context. Because the attack is delivered simply by getting a victim to view a crafted page, attackers have historically used watering-hole and drive-by techniques to reach targets at scale. The EPSS score of 87.3% (99.5th percentile) reflects near-certain exploitation activity, and because Internet Explorer is end-of-life, affected systems cannot depend on ongoing patching and should move to a supported browser.
Exploit Maturity
CVE-2010-0806 was exploited in the wild in March 2010, prompting Microsoft to release Security Advisory 981374 ahead of the MS10-018 update. It is listed on the CISA Known Exploited Vulnerabilities catalog, and the EPSS score of 87.3% (99.5th percentile) indicates near-certain exploitation activity. No exploit-tagged proof-of-concept appears in the NVD references — the available sources are vendor advisories such as the MS10-018 bulletin — but the flaw was rapidly weaponized after disclosure and integrated into exploit kits, and given Internet Explorer's end-of-life status, any system still running IE should discontinue its use.
Remediation
- Discontinue use of Internet Explorer as advised by CISA: the impacted product is end-of-life/end-of-service, so migrate to a supported, actively maintained browser instead of relying on the legacy component.
- Where IE must temporarily remain, apply the MS10-018 update (CISA KEV deadline 2026-06-03) on any supported underlying Windows version that can still receive it.
- As an interim mitigation, enforce Data Execution Prevention (DEP) for Internet Explorer and restrict browsing to trusted sites, since exploitation requires the victim to load a malicious page.
- Block untrusted web content at the proxy/gateway and deploy endpoint protection capable of detecting use-after-free exploitation and unexpected browser child processes.
- As long-term hardening against use-after-free and resource-management errors, remove or disable legacy browsers, standardize on a modern browser with strong memory-safety mitigations, and segment any systems that must continue running unsupported software.
Technical Details
CVE-2010-0806 is a use-after-free vulnerability (CWE-416), rooted in a resource management error (CWE-399), in the Peer Objects component (iepeers.dll) of Microsoft Internet Explorer 6, 6 SP1, and 7. Exploitation involves accessing an invalid pointer after the associated object has been deleted, allowing a crafted HTML page to reclaim the freed memory with attacker-controlled data and corrupt memory to achieve code execution — the behavior Microsoft labeled the "Uninitialized Memory Corruption Vulnerability." The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-deliverable, low-complexity attack requiring the victim to view a malicious page, after which the system is fully compromised in the user's context. The flaw was exploited in the wild in March 2010.
Frequently Asked Questions
Is CVE-2010-0806 being actively exploited?
Yes. CVE-2010-0806 was exploited in the wild in March 2010 and is on the CISA Known Exploited Vulnerabilities catalog, with an EPSS score of 87.3% (99.5th percentile) indicating near-certain ongoing exploitation activity against unpatched systems.
What products are affected by CVE-2010-0806?
The vulnerability affects Microsoft Internet Explorer 6, 6 SP1, and 7 (via the iepeers.dll Peer Objects component). Internet Explorer is end-of-life and should be discontinued in favor of a supported browser.
How do I fix CVE-2010-0806?
Discontinue use of Internet Explorer and migrate to a supported browser. Where IE temporarily remains and the underlying Windows version still receives updates, apply the Microsoft MS10-018 security update and enforce DEP as an interim measure.
How severe is CVE-2010-0806?
CVE-2010-0806 is rated HIGH with a CVSS 3.1 score of 8.8. A crafted web page can trigger a use-after-free leading to remote code execution in the user's context, and the flaw was confirmed exploited in the wild shortly after disclosure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.