CVE-2010-0249: Microsoft Internet Explorer use-after-free enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed in-the-wild exploitation, has public exploit code, and carries a very high EPSS score, so unpatched IE 6/7/8 hosts are at immediate risk.

What it is

Internet Explorer 6, 7 and 8 mishandle objects in memory, leaving a dangling pointer that can be reused after the object is freed. A remote attacker can corrupt memory through a crafted web page and execute arbitrary code in the context of the browsing user. The flaw was exploited in the wild in December 2009 and January 2010 during Operation Aurora.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the logged-on user, allowing installation of malware, data theft or full host compromise. No privilege escalation is needed beyond the victim's own rights.

Attack surface

Reached over the network via a malicious or compromised web page rendered by Internet Explorer; the CVSS vector shows no privileges required but user interaction required, so the victim must visit the page or open the crafted content.

Exploitation

CISA added this to the KEV catalog with a 2026-06-03 remediation due date, and EPSS gives a 30-day probability of 0.91939 (99.8th percentile). Public exploit code exists (Exploit-DB 11167, SecurityFocus BID 37815) and the description states it was exploited in the wild during Operation Aurora.

What to do

• Apply the Microsoft patch (MS10-002 / KB979352) or the vendor advisory mitigations immediately; this is the primary fix.
• If patching is not possible, discontinue use of Internet Explorer 6, 7 and 8 on the affected Windows versions, per CISA KEV required action.
• Enforce a modern supported browser and block or restrict legacy IE execution across the estate.
• Apply the workarounds in Microsoft Security Advisory 979352 (for example, restricting ActiveX/scripting or enabling DEP) as temporary compensating controls.
• Prioritize remediation on internet-facing and user-workstation systems running the affected Windows platforms.

Detection

• Hunt for IE processes (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for normal browsing.
• Monitor for outbound network connections from iexplore.exe to unfamiliar hosts, consistent with post-exploitation download or C2.
• Review proxy, IDS and web logs for known exploit delivery pages and for the public PoC patterns tied to this vulnerability.
• Check endpoint telemetry for memory corruption crashes in iexplore.exe followed by suspicious process creation on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.