CVEvulnerability

CVE-2010-3962

8.1 HIGH Known exploited Published 2010-11-05 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability — Microsoft Internet Explorer

Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Added to KEV: 2025-10-06
Remediation due: 2025-10-27
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN ; https://nvd.nist.gov/vuln/detail/CVE-2010-3962

Status: Analyzed
Published: 2010-11-05
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses: CWE-416

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

Affected configurations

• microsoft internet explorer 6 • microsoft internet explorer 7 • microsoft internet explorer 8

Related

Weakness · CWE (1)

CWE-416 Use After Free weakness

References

http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx Vendor Advisory
http://secunia.com/advisories/42091 Broken Link, Vendor Advisory
http://www.exploit-db.com/exploits/15418 Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/15421 Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/899748 Third Party Advisory, US Government Resource
http://www.microsoft.com/technet/security/advisory/2458511.mspx Patch, Vendor Advisory
http://www.securityfocus.com/bid/44536 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024676 Broken Link, Third Party Advisory, VDB Entry
http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks Not Applicable
http://www.us-cert.gov/cas/techalerts/TA10-348A.html Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2010/2880 Broken Link, Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/62962 Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279 Tool Signature
http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx Vendor Advisory
http://secunia.com/advisories/42091 Broken Link, Vendor Advisory
http://www.exploit-db.com/exploits/15418 Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/15421 Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/899748 Third Party Advisory, US Government Resource
http://www.microsoft.com/technet/security/advisory/2458511.mspx Patch, Vendor Advisory
http://www.securityfocus.com/bid/44536 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024676 Broken Link, Third Party Advisory, VDB Entry
http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks Not Applicable
http://www.us-cert.gov/cas/techalerts/TA10-348A.html Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2010/2880 Broken Link, Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/62962 Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279 Tool Signature
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962 US Government Resource