cbcvebase.
CVE-2011-1255
published 2011-06-16

CVE-2011-1255: The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in…

PriorityP273critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
42.10%
98.5th percentile
The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability."

Affected

3 ranges
VendorProductVersion rangeFixed in
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20547.rar↗
  • →Exploit targets Microsoft Internet Explorer 6 through 8 via the HTML+TIME (Timed Interactive Multimedia Extensions) implementation; monitor for suspicious use of TIME element behaviors in HTML content delivered to IE 6–8 clients. ↗
  • →Exploit is designed to bypass DEP and ASLR on Windows 7 with IE 8; detections should account for ROP-chain or heap-spray patterns in HTML/JS payloads targeting this platform. ↗
  • →The exploit is distributed as a RAR archive (20547.rar); inspect downloaded RAR files from untrusted sources for embedded IE exploit HTML/JS content referencing TIME elements. ↗
  • ·The exploit is attributed to a specific author and tested only on Windows 7 with IE 8; effectiveness against other IE 6/7 versions or OS combinations is not confirmed by the source. ↗

CVSS provenance

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.