Vulnerability record

CVE-2010-0249

Microsoft Internet Explorer Use-After-Free Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Internet Explorer, fix it now.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

US federal civilian agencies must remediate by Jun 3, 2026.

Patch status

Official fix available since Sep 29, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Source
Internet Explorer	Microsoft	5.0.1; 6; 7.0; 8	KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 29, 2026
CVE-2010-0249 scored CVSS 8.8: Microsoft Internet Explorer, Microsoft Internet Explorer Use-After-Free Vulnerability
CISA lists this as exploited in the wild. Unpatched Internet Explorer systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
Patch releasedUpdateKEVSep 29, 2026
Patch released for CVE-2010-0249: Microsoft Internet Explorer, Microsoft Internet Explorer Use-After-Free Vulnerability
An official fix is now available for Microsoft Internet Explorer. This vulnerability is being exploited, so apply it promptly.
Basis: NVD patch reference

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

learn.microsoft.com https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352
nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2010-0249
blogs.technet.com http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx
news.cnet.com http://news.cnet.com/8301-27080_3-10435232-245.html
osvdb.org http://osvdb.org/61697
securitytracker.com http://securitytracker.com/id?1023462
support.microsoft.com http://support.microsoft.com/kb/979352
exploit-db.com http://www.exploit-db.com/exploits/11167
kb.cert.org http://www.kb.cert.org/vuls/id/492515
microsoft.com http://www.microsoft.com/technet/security/advisory/979352.mspx
securityfocus.com http://www.securityfocus.com/bid/37815
us-cert.gov http://www.us-cert.gov/cas/techalerts/TA10-055A.html
vupen.com http://www.vupen.com/english/advisories/2010/0135
docs.microsoft.com https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/55642
oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0249