CVE-2010-3329

published 2010-10-13

CVE-2010-3329: mshtmled.dll in Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code via a crafted Microsoft Office document that causes the…

Priority P2 59 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

mshtmled.dll in Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code via a crafted Microsoft Office document that causes the HtmlDlgHelper class destructor to access uninitialized memory, aka "Uninitialized Memory Corruption Vulnerability."

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename mshtmled.dll↗

other CLASSID:3050f4e1-98b5-11cf-bb82-00aa00bdce0b↗

version mshtmled.dll v8.0.6001.18702↗

version mshtmled.dll v8.0.6001.18000↗

version mshtmled.dll v7.0.6000.17023↗

version mshtmled.dll v7.0.6000.17080↗

• → Monitor for instantiation of the HtmlDlgHelper ActiveX control (CLSID 3050f4e1-98b5-11cf-bb82-00aa00bdce0b) from within Microsoft Office documents (.XLS, .DOC), particularly in Office 2003 where the crash is triggered even if the user declines the ActiveX prompt. ↗
• → Detect crashes or access violations in mshtmled.dll originating from the CHtmlDlgHelper destructor call stack: mshtmled!ReleaseInterface -> mshtmled!CHtmlDlgHelper::~CHtmlDlgHelper -> mshtmled!ATL::CComAggObject::Release, especially when spawned from EXCEL.EXE or Office processes. ↗
• → Flag Office documents (.XLS, .DOC) that embed an ActiveX object with CLASSID 3050f4e1-98b5-11cf-bb82-00aa00bdce0b, as this is the trigger for the HtmlDlgHelper memory corruption vulnerability. ↗
• → In Office 2003, the vulnerability is triggered regardless of user response to the ActiveX safety prompt — detection should not rely solely on user acceptance of the ActiveX dialog. ↗

• · In Microsoft Office 2007 and Office 2010, the HtmlDlgHelper ActiveX control is disabled by default, significantly reducing attack surface on those platforms. ↗
• · The ActiveX control is marked 'Not Safe for Initialization' and normally prompts the user before execution; however, in Office 2003 the crash occurs even when the user denies the prompt, making user-interaction mitigations unreliable for that version. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94