Old Internet Explorer flaws CVE-2010-0249 and CVE-2010-0806 added to CISA's exploited list
CISA listed two 2010 Internet Explorer flaws (CVE-2010-0249, CVE-2010-0806) as exploited on 20 May 2026. Microsoft fixed both in 2010. Anyone still running unpatched old Windows with IE should update or stop using it; IE is end-of-life.
Make sure Windows is fully updated and use a current browser such as Edge, Chrome or Firefox rather than Internet Explorer. If a family member's computer is too old to update, replace it or stop using it for browsing.
- Internet Explorerfixed in MS10-018 cumulative update (980182) and later
What’s happening
On 20 May 2026 the US cyber agency CISA added two Internet Explorer memory flaws from 2010 to its list of vulnerabilities known to be used in attacks. Both are use-after-free bugs, where the browser reuses memory it has already released. A booby-trapped web page could use them to run an attacker's code with the visitor's permissions. CVE-2010-0249 was fixed by Microsoft in bulletin MS10-002 in January 2010, after Microsoft reported limited targeted attacks at the time. CVE-2010-0806 was fixed in the cumulative update MS10-018 in March 2010; Microsoft said it had been publicly disclosed. A news report says a group called GREF used it as a zero-day, though Microsoft's page we read does not say so. CISA notes Internet Explorer may be end-of-life and says users should stop using it. The risk now falls on very old, unpatched Windows computers. We found no new Microsoft statement or fix since 2010.
- What
- Flaw
- Affects
- Microsoft Internet Explorer (versions 5.01 to 8 on older Windows)
- Affected
- Internet Explorer 5.01 SP4 on Windows 2000 SP4 (MS10-018)
Internet Explorer 6 on Windows 2000, XP and Server 2003 (MS10-018)
Internet Explorer 7 on Windows XP, Vista and Server 2003/2008 (MS10-018)
Internet Explorer 8 on Windows XP, Vista and Server 2003/2008, but not Windows 7 for CVE-2010-0806 (MS10-018) - Fixed in
- MS10-002 (January 2010) for CVE-2010-0249
MS10-018 (980182, March 2010) for CVE-2010-0806 - Since
- 20 May 2026
- Closed
- 20 May 2026
Timeline
- CISA added
CISA added CVE-2010-0249 and CVE-2010-0806 to its Known Exploited Vulnerabilities list, noting the product may be end-of-life and that users should stop using it. Federal agencies were given until 3 June 2026 to act.
- New fixFixed
Microsoft released MS10-018, a cumulative Internet Explorer update covering 10 flaws including CVE-2010-0806, which it said had been publicly disclosed. It affected IE 5.01, 6, 7 and 8 on various Windows versions, but not IE8 on Windows 7.
- New fixFixed
Microsoft issued security bulletin MS10-002 to fix CVE-2010-0249 and updated the advisory to point to it.
- Wider attacks
Microsoft revised the advisory to reflect its investigation of limited targeted attacks, and on 20 January again to reflect the changing nature of the attacks.
- Made publicNo fix yet
Microsoft published Security Advisory 979352 on an Internet Explorer flaw, the HTML Object Memory Corruption Vulnerability (CVE-2010-0249).
Sources
- Microsoft Security Advisory 979352Microsoft · 21 Jan 2010
- Microsoft Security Bulletin MS10-018: Cumulative Security Update for Internet Explorer (980182)Microsoft · 30 Mar 2010
- U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 21 May 2026