Vulnerability record · CVE-2010-0248 · published 22 January 2010
CVE-2010-0248: Internet Explorer memory corruption in HTML object handling
Microsoft · Internet Explorer
Internet Explorer 6, 6 SP1, 7 and 8 fail to properly handle objects in memory, allowing remote code execution when an object is accessed that was not properly initialized or has been deleted. This is a use-after-free style memory corruption flaw in the browser's HTML object handling, tracked as the HTML Object Memory Corruption Vulnerability and fixed in MS10-002.
Description
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability."
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution with no privileges or interaction required in the vector, plus a very high EPSS score, though the affected browser versions are long obsolete and no KEV listing or known exploit tag is present.
What it is
Internet Explorer 6, 6 SP1, 7 and 8 fail to properly handle objects in memory, allowing remote code execution when an object is accessed that was not properly initialized or has been deleted. This is a use-after-free style memory corruption flaw in the browser's HTML object handling, tracked as the HTML Object Memory Corruption Vulnerability and fixed in MS10-002.
Impact
A remote attacker can execute arbitrary code in the context of the logged-on user, giving full control of the affected system if the user has administrative rights. Typical outcomes include code execution, data theft, and installation of further malware.
Attack surface
Reached over the network via a crafted web page or HTML content rendered by the vulnerable browser; the CVSS vector shows no privileges required and no user interaction, though in practice a victim must load the malicious content in IE. No authentication is needed.
Exploitation
Not listed in CISA KEV and no reference tags indicate exploit availability, but EPSS is very high at 0.53085 (99th percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Apply Microsoft security bulletin MS10-002, which addresses this vulnerability, or upgrade to a supported browser version
- Retire Internet Explorer 6, 7 and 8 from production use; they are long out of support
- Enforce a modern browser as default and block or restrict legacy IE rendering modes where possible
- Apply network and email filtering to block known malicious HTML and exploit pages
- Keep endpoint protection and browser exploit mitigations (such as EMET-style protections) enabled on any remaining legacy systems
Detection
- Monitor for IE processes (iexplore.exe) spawning unexpected child processes such as cmd.exe, powershell.exe or scripting hosts
- Hunt for crashes or abnormal terminations of iexplore.exe correlated with visits to untrusted sites
- Review proxy and web logs for requests to known exploit-hosting domains or suspicious HTML content served to legacy IE user agents
- Alert on memory corruption indicators or exploit signatures in endpoint telemetry for legacy IE versions
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-0248 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-0248), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
