{"id":"internet-explorer-use-after-free-cisa-kev-may","category":"patch","status":"closed","title":"Old Internet Explorer flaws CVE-2010-0249 and CVE-2010-0806 added to CISA's exploited list","tldr":"CISA listed two 2010 Internet Explorer flaws (CVE-2010-0249, CVE-2010-0806) as exploited on 20 May 2026. Microsoft fixed both in 2010. Anyone still running unpatched old Windows with IE should update or stop using it; IE is end-of-life.","summary":"On 20 May 2026 the US cyber agency CISA added two Internet Explorer memory flaws from 2010 to its list of vulnerabilities known to be used in attacks. Both are use-after-free bugs, where the browser reuses memory it has already released. A booby-trapped web page could use them to run an attacker's code with the visitor's permissions. CVE-2010-0249 was fixed by Microsoft in bulletin MS10-002 in January 2010, after Microsoft reported limited targeted attacks at the time. CVE-2010-0806 was fixed in the cumulative update MS10-018 in March 2010; Microsoft said it had been publicly disclosed. A news report says a group called GREF used it as a zero-day, though Microsoft's page we read does not say so. CISA notes Internet Explorer may be end-of-life and says users should stop using it. The risk now falls on very old, unpatched Windows computers. We found no new Microsoft statement or fix since 2010.","action":"Make sure Windows is fully updated and use a current browser such as Edge, Chrome or Firefox rather than Internet Explorer. If a family member's computer is too old to update, replace it or stop using it for browsing.","product":"Microsoft Internet Explorer (versions 5.01 to 8 on older Windows)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2010-0249","CVE-2010-0806"],"tags":["microsoft","internet-explorer","windows","cisa-kev","use-after-free","end-of-life","legacy"],"affected":["Internet Explorer 5.01 SP4 on Windows 2000 SP4 (MS10-018)","Internet Explorer 6 on Windows 2000, XP and Server 2003 (MS10-018)","Internet Explorer 7 on Windows XP, Vista and Server 2003/2008 (MS10-018)","Internet Explorer 8 on Windows XP, Vista and Server 2003/2008, but not Windows 7 for CVE-2010-0806 (MS10-018)"],"fixed":["MS10-002 (January 2010) for CVE-2010-0249","MS10-018 (980182, March 2010) for CVE-2010-0806"],"matches":[{"platform":"windows","app":"Internet Explorer","bundle":"","fixed":"MS10-018 cumulative update (980182)"}],"sources":[{"kind":"advisory","title":"Microsoft Security Advisory 979352","url":"https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352","by":"Microsoft","date":"2010-01-21"},{"kind":"advisory","title":"Microsoft Security Bulletin MS10-018: Cumulative Security Update for Internet Explorer (980182)","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018","by":"Microsoft","date":"2010-03-30"},{"kind":"news","title":"U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/192508/security/u-s-cisa-adds-microsoft-and-adobe-flaws-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","date":"2026-05-21"}],"started":"2026-05-20","closed":"2026-05-20","created":"2026-11-03T21:45:11.955Z","updated":"2026-11-03T21:45:11.955Z","cve_notes":[{"cve":"CVE-2010-0249","name":"Use-after-free in Internet Explorer's HTML handling","what":"A use-after-free in how Internet Explorer handles HTML objects (Microsoft calls it HTML Object Memory Corruption) that a booby-trapped web page could use to run an attacker's code.","severity":"high","cvss":8.8},{"cve":"CVE-2010-0806","name":"Use-after-free in Internet Explorer memory handling","what":"A memory flaw in Internet Explorer that lets code access an invalid pointer after an object is deleted, so a malicious page could run an attacker's code; Microsoft's bulletin calls it uninitialized memory corruption.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-05-20","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added CVE-2010-0249 and CVE-2010-0806 to its Known Exploited Vulnerabilities list, noting the product may be end-of-life and that users should stop using it. Federal agencies were given until 3 June 2026 to act.","url":"https://securityaffairs.com/192508/security/u-s-cisa-adds-microsoft-and-adobe-flaws-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","patch":null},{"at":"2010-03-30","added":"2026-11-03T21:41:32.717Z","kind":"new-fix","text":"Microsoft released MS10-018, a cumulative Internet Explorer update covering 10 flaws including CVE-2010-0806, which it said had been publicly disclosed. It affected IE 5.01, 6, 7 and 8 on various Windows versions, but not IE8 on Windows 7.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018","by":"Microsoft","patch":"patched"},{"at":"2010-01-21","added":"2026-11-03T21:41:32.717Z","kind":"new-fix","text":"Microsoft issued security bulletin MS10-002 to fix CVE-2010-0249 and updated the advisory to point to it.","url":"https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352","by":"Microsoft","patch":"patched"},{"at":"2010-01-15","added":"2026-11-03T21:41:32.717Z","kind":"wider-attacks","text":"Microsoft revised the advisory to reflect its investigation of limited targeted attacks, and on 20 January again to reflect the changing nature of the attacks.","url":"https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352","by":"Microsoft","patch":null},{"at":"2010-01-14","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"Microsoft published Security Advisory 979352 on an Internet Explorer flaw, the HTML Object Memory Corruption Vulnerability (CVE-2010-0249).","url":"https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352","by":"Microsoft","patch":"none"}],"url":"https://hard.fyi/live/internet-explorer-use-after-free-cisa-kev-may/","json":"https://hard.fyi/api/live?id=internet-explorer-use-after-free-cisa-kev-may"}