CVE-2010-0806

Undergoing Analysis

Published: 10 Mar 2010, 22:00

Last modified:20 May 2026, 17:14

Vulnerability Summary

Overall Risk (default)

high

70/100

CVSS Score

9.3 HIGH

v2.0 (nvd)

EPSS Score

89.48% CRITICAL

89% probability -1.39%

KEV

Listed

CISA

1 listing

Ransomware

No reports

Public exploits

3 found

Dark Web

Not detected

Timeline

10 Mar 2010, 22:00

Published

Vulnerability first disclosed

20 May 2026, 00:00

Added to CISA KEV

Microsoft Internet Explorer Use-After-Free Vulnerability

20 May 2026, 17:14

Last Modified

Vulnerability information updated

03 Jun 2026, 00:00

CISA Remediation Due

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."

CVSS Metrics

v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
v2.0•HIGH•Score: 9.3AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 89.48%• Percentile: 100%

Techniques & Countermeasures

CWE-399•Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
CWE-416•Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

microsoft•internet_explorer
7 | 6
microsoft•windows_server_2008
na
microsoft•windows_xp
na