CVE-2010-3962: Internet Explorer CSS use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is a remotely reachable, unauthenticated code-execution flaw in widely deployed legacy IE that is confirmed exploited in the wild and listed in CISA KEV.

What it is

Microsoft Internet Explorer 6, 7 and 8 contain a use-after-free (uninitialized memory corruption) flaw triggered by CSS token sequences involving the clip attribute. A remote attacker can corrupt memory and execute arbitrary code in the context of the browsing user. The issue was exploited in the wild in November 2010, making it a real, not theoretical, risk for unpatched systems.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the user running Internet Explorer, enabling malware installation, data theft or further lateral movement.

Attack surface

Reached over the network by a victim viewing a crafted web page or HTML document in a vulnerable IE version; no authentication is required. The CVSS vector lists UI:N, but the description implies the user must load the malicious content, so practical exploitation depends on the victim visiting or opening the page.

Exploitation

CVE-2010-3962 is listed in CISA KEV (added 2025-10-06) and the description states it was exploited in the wild in November 2010; EPSS is 0.96889 (99.886th percentile). Public Exploit-DB entries (15418, 15421) exist, and no ransomware campaign use is documented.

What to do

• Apply Microsoft security bulletin MS10-090 (or the corresponding vendor patch) to all affected IE 6, 7 and 8 installations.
• Upgrade to a supported browser and remove or block legacy Internet Explorer where business needs allow.
• Enforce the vendor advisory 2458511 mitigations if patching cannot be completed immediately.
• Restrict or disable ActiveX and script execution in legacy IE via zone and group policy settings.
• Retire or isolate systems that cannot be patched, per CISA BOD 22-01 guidance.

Detection

• Monitor for IE processes (iexplore.exe) spawning unexpected child processes such as cmd.exe, powershell.exe or script hosts.
• Hunt for crash or exploit telemetry in IE rendering components tied to CSS/clip handling on endpoints running IE 6-8.
• Review web proxy and DNS logs for known exploit-hosting domains and for delivery of pages containing suspicious CSS clip sequences.
• Check for the presence of MS10-090 across the estate and flag unpatched IE 6/7/8 hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.