Microsoft Internet Explorer Use-After-Free Vulnerability

ALTO 8.8EXPLOITED (CISA KEV)CVE-2010-0806 · Published 10/03/2010 · updated 16/06/2026

Microsoft Internet Explorer Use-After-Free Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 20/05/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
internet explorer microsoft	`= 5.01= 6= 7= 8`	No fix yet

Description

Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."

References

blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx · Broken Link
osvdb.org/62810 · Broken Link
secunia.com/advisories/38860 · Vendor Advisory
kb.cert.org/vuls/id/744549 · Patch
microsoft.com/technet/security/advisory/981374.mspx · Broken Link
securityfocus.com/bid/38615 · Broken Link
us-cert.gov/cas/techalerts/TA10-068A.html · US Government Resource
us-cert.gov/cas/techalerts/TA10-089A.html · US Government Resource
vupen.com/english/advisories/2010/0567 · Vendor Advisory
vupen.com/english/advisories/2010/0744 · Vendor Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/56772 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446 · Broken Link
learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018 · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2010-0806

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free