CVE-2009-3672: Internet Explorer 6 and 7 memory corruption via CSS object handling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe vulnerability allows remote code execution with no authentication, public exploit code is referenced, and EPSS is very high, though the affected product is legacy and no KEV listing is present.

What it is

Internet Explorer 6 and 7 mishandle objects in memory that were not properly initialized or were deleted, corrupting memory in mshtml.dll. A remote attacker can trigger this through a crafted page that calls getElementsByTagName for the STYLE tag, selects the single returned element, and changes its outerHTML property. The flaw allows arbitrary code execution in the context of the browsing user.

Impact

Successful exploitation gives the attacker the ability to execute arbitrary code with the privileges of the user running Internet Explorer. Because the vulnerable versions run on client systems, this typically means full control of the affected workstation.

Attack surface

The attack is network-reachable (AV:N) and requires no authentication (Au:N), but does require user interaction (AC:M) such as visiting a malicious or compromised web page. The vector is a crafted HTML/CSS document that manipulates the STYLE element through getElementsByTagName and outerHTML.

Exploitation

A SecurityFocus reference is tagged Exploit and a Symantec blog describes a published zero-day exploit, indicating public exploit code exists. The CVE is not listed in CISA KEV, but EPSS is very high at 0.718 (99.4th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply Microsoft security bulletin MS09-072, which addresses this vulnerability, or upgrade to a supported Internet Explorer version.
• If patching cannot be done immediately, disable or restrict Active Scripting and consider the mitigations in Microsoft Security Advisory 977981.
• Enforce a modern browser as the default and block or restrict use of Internet Explorer 6 and 7 on managed endpoints.
• Use network controls to block known malicious domains and untrusted content that targets this flaw.

Detection

• Monitor for crashes or abnormal process terminations in iexplore.exe, especially when loading pages with heavy CSS or STYLE element manipulation.
• Hunt for suspicious child processes spawned by iexplore.exe, such as cmd.exe, powershell.exe, or scripting hosts, which may indicate successful code execution.
• Review proxy and web logs for requests to known exploit-hosting domains or pages containing getElementsByTagName('STYLE') and outerHTML patterns.
• Use endpoint detection to flag memory corruption indicators or exploit-like behavior in mshtml.dll within Internet Explorer processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.