CVE-2012-0155: Internet Explorer 9 VML use-after-free remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code execution with complete impact and has a very high EPSS score, though it is not in KEV and affects only the legacy IE9 browser.

What it is

Microsoft Internet Explorer 9 mishandles objects in memory, allowing a remote attacker to execute arbitrary code by accessing a deleted object. This is the VML Remote Code Execution Vulnerability addressed in MS12-010. Because it is a memory corruption flaw in a widely deployed browser, it matters for any environment still running IE9.

Impact

An attacker who successfully exploits the flaw gains arbitrary code execution in the context of the logged-on user. Full compromise of confidentiality, integrity and availability is possible, as reflected in the CVSS 2.0 score of 9.3.

Attack surface

The vector is AV:N/AC:M/Au:N/C:C/I:C/A:C, so it is reachable over the network with no authentication required, but some user action is needed (typically viewing a crafted web page or document). The description does not specify the exact delivery mechanism beyond accessing a deleted object.

Exploitation

CISA KEV does not list this CVE, and no ransomware usage is documented. EPSS is high at 0.655 (99.2nd percentile), and references include only vendor, US-CERT and OVAL material, with no public exploit tag.

What to do

• Apply the MS12-010 security update from Microsoft, which is the vendor patch for this vulnerability.
• Upgrade or migrate off Internet Explorer 9 to a supported browser, since IE9 is long out of support.
• Enforce network and email filtering to block known malicious pages and attachments that target browser memory corruption.
• Harden the browser with mitigations such as Enhanced Protected Mode and DEP/ASLR where applicable.
• Restrict privileged browsing and administrative use of legacy IE9 to reduce the impact of a successful exploit.

Detection

• Monitor for IE9 process crashes or abnormal terminations that could indicate use-after-free exploitation attempts.
• Hunt for suspicious child processes spawned by iexplore.exe, such as scripting hosts or command shells.
• Review proxy and IDS/IPS logs for known exploit URLs or VML-based malicious content targeting this CVE.
• Use the OVAL definition oval:org.mitre.oval:def:14781 to scan for unpatched IE9 installations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.