CVE-2010-2561: Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial…

PriorityP260critical9.3CVSS 2.0

AVNACMAuNCCICAC

EXPLOIT

EPSS

24.87%

97.7th percentile

Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted response, aka "Msxml2.XMLHTTP.3.0 Response Handling Memory Corruption Vulnerability."

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	xml_core_services	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/RandomHTTP?counter=↗

→Trigger is a malformed/truncated HTTP response line ('HTTP 4\n') sent to Msxml2.XMLHTTP.3.0 — detect HTTP responses that begin with a partial/invalid status line (e.g., 'HTTP 4' with no valid status code) directed at an MSXML consumer. ↗
→Exploit uses ActiveXObject('Msxml2.XMLHTTP.3.0') in a tight loop via setTimeout to repeatedly issue GET requests to a malformed-response endpoint — look for rapid, repeated XHR requests from IE to the same host path matching /RandomHTTP?counter=<digits>. ↗

·The vulnerability is specific to MSXML 3.0 (Msxml2.XMLHTTP.3.0 ActiveX object); other MSXML versions are not affected by this particular memory corruption. ↗
·The PoC exploit runs its own HTTP server on a hardcoded port (28876); real-world weaponized variants may use any port, so port-based detection alone is insufficient. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.