CVE-2009-0075: Internet Explorer 7 uninitialized memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with no authentication and public exploit code, though the affected product is a long-obsolete browser.

What it is

Microsoft Internet Explorer 7 mishandles errors when accessing deleted objects, specifically involving CFunctionPointer and the appending of document objects, leading to uninitialized memory corruption. A remote attacker can trigger this with a crafted HTML document and execute arbitrary code in the context of the browsing user.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the logged-on user. Because IE 7 ran with full user rights on most systems, this typically means full control of the affected host.

Attack surface

The flaw is reached over the network by viewing a crafted HTML document in Internet Explorer 7; no authentication is required, but the victim must be lured into opening the page or a link to it (user interaction).

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.85277, 99.7th percentile) and multiple Exploit-DB entries exist, indicating public exploit code is available.

What to do

• Apply Microsoft security bulletin MS09-002, which patches this vulnerability.
• Upgrade or migrate off Internet Explorer 7 to a supported browser.
• Enforce Protected Mode and current IE security zone settings where IE must remain in use.
• Block or restrict untrusted web content and known exploit hosts at the network boundary.

Detection

• Monitor for IE 7 processes (iexplore.exe) spawning child processes or making unexpected network connections.
• Hunt for crashes or memory corruption events in iexplore.exe tied to web browsing.
• Review proxy and DNS logs for known exploit-hosting domains and suspicious HTML delivery.
• Use endpoint detection to flag shellcode-like behavior originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.