{"id":"CVE-2010-3962","published":"2010-11-05T17:00:02Z","modified":"2026-06-16T23:23:53Z","title":"Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability","vendor":"Microsoft","product":"Internet Explorer","tier":"core","eol":{"product":"Internet Explorer","since":"2022-06-15","note":"No security updates; remove it."},"description":{"text":"Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an \"invalid flag reference\" issue or \"Uninitialized Memory Corruption Vulnerability,\" as exploited in the wild in November 2010.","provenance":"source","from":"NVD"},"summary":{"text":"Microsoft Internet Explorer 6, 7, and 8 contains a use-after-free flaw in its handling of Cascading Style Sheets token sequences and the clip attribute, which is also described as an \"invalid flag reference\" and uninitialized memory corruption issue. A remote attacker can exploit it to execute arbitrary code, with no authentication required and no user interaction needed, though the attack is considered high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:47Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.96831,"percentile":0.99887,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2025-10-06","dueDate":"2025-10-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN ; https://nvd.nist.gov/vuln/detail/CVE-2010-3962","provenance":"source"},"vulncheckKev":{"dateAdded":"2010-11-05","exploitedFirstSeen":"2010-11-05","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3962","date":"2010-11-05"},{"url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong","date":"2016-09-06"},{"url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit","date":"2019-05-06"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-06"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://insights.nccgroup.com/annual-threat-intelligence-report-2025","date":"2026-03-05"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"OperationMalformed","url":"https://otx.alienvault.com/pulse/6ad63a104127027a3a2a237a","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42091","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/15418","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/15421","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.kb.cert.org/vuls/id/899748","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.microsoft.com/technet/security/advisory/2458511.mspx","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/44536","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1024676","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks","tags":["Not Applicable"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-348A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2010/2880","tags":["Broken Link","Vendor Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090","tags":["Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/62962","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279","tags":["Tool Signature"]},{"url":"http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42091","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/15418","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/15421","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.kb.cert.org/vuls/id/899748","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.microsoft.com/technet/security/advisory/2458511.mspx","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/44536","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1024676","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks","tags":["Not Applicable"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-348A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2010/2880","tags":["Broken Link","Vendor Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090","tags":["Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/62962","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279","tags":["Tool Signature"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: drive-by via crafted web content","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets","start":72,"end":167}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution on victim","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":72,"end":121}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-bc9af9dd604bcbbd89cd","title":"RECON MTL 2017 evolution of pirpi","publisher":"recon.cx","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf","date":null,"mentions":[{"quote":"• (CVE-2010-3962)","start":478,"end":495}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-3939","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-3939","exploited":true,"exploitedSince":"2025-10-06","provenance":"source"},"exploits":[{"id":15418,"url":"https://www.exploit-db.com/exploits/15418","title":"Microsoft Internet Explorer - Memory Corruption","type":"dos","platform":"windows","date":"2010-11-04","verified":true,"provenance":"source"},{"id":15421,"url":"https://www.exploit-db.com/exploits/15421","title":"Microsoft Internet Explorer 6/7/8 - Memory Corruption","type":"remote","platform":"windows","date":"2010-11-04","verified":true,"provenance":"source"},{"id":16551,"url":"https://www.exploit-db.com/exploits/16551","title":"Microsoft Internet Explorer - CSS SetUserClip Memory Corruption (MS10-090) (Metasploit)","type":"remote","platform":"windows","date":"2011-01-20","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2010-11-04"},"metasploit":[{"name":"MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption","module":"exploit/windows/browser/ms10_090_ie_css_clip","type":"exploit","disclosureDate":"2010-11-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb"}],"first":{"date":"2010-11-03","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/15418","http://www.exploit-db.com/exploits/15421"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1189"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2010-11-03","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2010-11-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb","provenance":"source"},{"date":"2010-11-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3962","provenance":"source"},{"date":"2010-11-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2010-3962","provenance":"source"},{"date":"2025-10-06","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-3939","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":5449},"priority":{"score":57.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5837 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 Exploit-DB entries; 2 NVD exploit links; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-microsoft-internet-explorer-cwe-416"}}