Intel

CVE-2010-0249

Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability

criticalKEV: actively exploitedPoCEPSS 92%

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."

Source: CISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2010-0249 appears on CISA KEV because IE components — specifically the Trident engine (mshtml.dll) — remain active in some environments, including legacy SCADA HMIs, older intranet applications, and via IE Compatibility Mode in Edge. The CVSS v3 score of 8.8 (AV:N/AC:L/PR:N/UI:R) combined with an EPSS percentile of 99.8 % confirms that reliable, publicly available exploit code exists. The attack vector is trivially replicable: a single user click on a crafted web page is sufficient for full code execution. For NIS2-regulated organisations with legacy systems in OT or administrative networks, residual exposure to this vulnerability must be treated as critical and resolved without delay.

Runbook · Step 1

Immediate response (0-24 h)

  • Remove or fully disable Internet Explorer immediately — IE 6, 6 SP1, 7, and 8 are end-of-life and receive no further security updates. Prioritise uninstallation or disabling via Windows Features (Control Panel → Windows Features → uncheck "Internet Explorer").
  • Apply MS10-002 where still applicable: Microsoft's patch MS10-002 addressed this vulnerability. Since Windows XP, Vista, and Server 2003/2008 are also EoL, patching is only realistic on Windows 7 / Server 2008 R2 — deploy MS10-002 immediately on any remaining in-scope systems if not already applied.
  • Inventory all systems where IE is configured as the default or fallback browser — pay particular attention to legacy applications depending on IE ActiveX components or the Trident rendering engine (e.g. older intranet portals, SCADA HMIs).
  • Restrict network access for affected systems: Systems that cannot replace IE immediately (due to application dependencies) must be isolated from the internet — enforce outbound HTTP/HTTPS (ports 80/443) exclusively through an allowlisted proxy.
  • Rotate credentials for all accounts that were active on affected systems, since successful exploitation yields remote code execution under the privileges of the logged-in user.

Runbook · Step 2

Mitigation layers

  • Enforce browser replacement via GPO: Deregister IE as the default browser and block execution of iexplore.exe using a Software Restriction Policy or AppLocker rule targeting %ProgramFiles%\Internet Explorer\iexplore.exe.
  • Enable Enhanced Protected Mode (EPM) and EMET on remaining Windows 7 / Server 2008 R2 systems — configure EMET rules for iexplore.exe with DEP, ASLR, SEHOP, and heap-spray protection enabled.
  • Network segmentation / proxy enforcement: Route all outbound connections from legacy systems exclusively through an inspecting proxy (e.g. Squid with SSL bump or a cloud proxy); block direct internet egress at the firewall.
  • IPS/IDS signature: Enable Snort/Suricata rules covering known Aurora exploit shellcode patterns — check the Emerging Threats ruleset for ET EXPLOIT MS Internet Explorer Use After Free and activate the relevant SIDs.
  • Set ActiveX kill bits: Apply kill bits for all non-essential ActiveX CLSIDs via registry (HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CLSID}\Compatibility Flags = 0x00000400) or GPO to reduce the attack surface.
  • Least privilege: Ensure any users still required to run IE operate exclusively with standard user rights (no local admin); set UAC to its highest enforcement level.

Runbook · Step 3

Detection rules

  • Windows Event Log / Sysmon EID 1 (Process Create): Unexpected child processes spawned by iexplore.exe — especially cmd.exe, powershell.exe, wscript.exe, mshta.exe, or unknown binaries from %TEMP%. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "iexplore.exe" and FileName in~ ("cmd.exe","powershell.exe","wscript.exe","mshta.exe")
  • Sysmon EID 7 (Image Load): Unknown or unsigned DLLs loaded into the iexplore.exe process space — indicator of shellcode staging or DLL injection following successful exploitation.
  • EDR process tree: iexplore.exe spawning a child process that immediately opens an outbound network connection (Sysmon EID 3) — particularly to unknown IPs on ports 80/443/8080 shortly after process creation.
  • Web proxy logs / Zeek HTTP: Requests from IE-running hosts containing unusually long or obfuscated query strings — look for %u-encoded shellcode sequences in the HTTP request URI.
  • Windows Security EID 4688 / auditd: Process creation with anomalous parent-child chains such as iexplore.exe → rundll32.exe or regsvr32.exe as a post-exploitation indicator. Sigma shape: ParentImage|endswith: 'iexplore.exe' combined with Image|endswith: 'rundll32.exe'.

Metrics

Severity
critical
Priority score
224.53
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
91.9 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-05-20 00:00 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • microsoft

    internet_explorer

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2010-0249
Microsoft Internet Explorer — Microsoft Internet Explorer Use-After-Free Vulnerability — CVE-2010-0249 | NEOSEC Intel