CVE-2010-0249 describes a critical use-after-free vulnerability in Microsoft Internet Explorer versions 6, 7, and 8 across various Windows operating systems. This flaw allows remote attackers to execute arbitrary code by manipulating memory pointers associated with deleted objects. With a CVSS score of 8.8 (High), it presents a significant risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. The vulnerability was actively exploited in the wild during Operation Aurora in late 2009 and early 2010, with public exploit modules available in Metasploit and ExploitDB, and has garnered considerable community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.0.1CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:* | ||
6CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* | ||
6CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_explorer:6:-:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:* | ||
8CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.