⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2010-0249 — Use After Free in Microsoft Internet Explorer

CWE-416 — Use After Free13 documents8 sources
Severity
8.8HIGHNVD
EPSS
90.1%
top 0.41%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Microsoft Internet Explorer
Timeline
PublishedJan 15
Latest updateFeb 12

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Opera…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDmicrosoft/internet_explorer4 versions+3

Patches

Patch: support.microsoft.com ↗Patch: www.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-x2mp-6fmq-52qw: Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; W↗2022-05-02
▶
VulnCheck
Microsoft Internet Explorer Use After Free↗2010
▶

💥Exploits & PoCs

3
Exploit-DB
Microsoft Internet Explorer - 'Aurora' Memory Corruption (MS10-002) (Metasploit)↗2010-07-12
▶
Exploit-DB
Microsoft Internet Explorer 6 - 'Aurora' Memory Corruption (MS10-002)↗2010-01-17
▶
Metasploit
MS10-002 Microsoft Internet Explorer "Aurora" Memory Corruption↗
▶

🕵️Threat Intelligence

5
Zscaler
Robint.us SideNote: "CuteQQ" | Zscaler↗2010-06-10
▶
Zscaler
Inline Detection Of Evil JavaScript | Zscaler↗2010-05-11
▶
Zscaler
Zscaler Deploys Protections for Internet Explorer Zero-Day Vulnerability | Zscaler↗
▶
Zscaler
Zscaler Positioned in the Visionaries Quadrant of the Magic Quadrant for Secure Web Gateway | Zscaler↗
▶
Zscaler
Zscaler protects against Operation Aurora | 01-20-2010↗
▶

📐Framework References

1
CWE
Use After Free↗
▶

📄Research Papers

1
arXiv
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures↗2025-02-12
▶
CVE-2010-0249 — Use After Free in Microsoft | cvebase