Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

HIGH 8.1EXPLOITED (CISA KEV)CVE-2010-3962 · Published 05/11/2010 · updated 16/06/2026

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 06/10/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
internet explorer microsoft	`= 6= 7= 8`	No fix yet

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

References

blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx · Vendor Advisory
secunia.com/advisories/42091 · Broken Link
exploit-db.com/exploits/15418 · Third Party Advisory
exploit-db.com/exploits/15421 · Third Party Advisory
kb.cert.org/vuls/id/899748 · Third Party Advisory
microsoft.com/technet/security/advisory/2458511.mspx · Patch
securityfocus.com/bid/44536 · Broken Link
securitytracker.com/id · Broken Link
symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks · Not Applicable
us-cert.gov/cas/techalerts/TA10-348A.html · Third Party Advisory
vupen.com/english/advisories/2010/2880 · Broken Link
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 · Patch
exchange.xforce.ibmcloud.com/vulnerabilities/62962 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279 · Tool Signature
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2010-3962

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free