CVE-2010-0806: Microsoft Internet Explorer use-after-free in Peer Objects

CVE-2010-0806 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2026-05-20

Microsoft Internet Explorer contains a critical vulnerability in how it handles memory for certain web objects. An attacker could exploit this by tricking a user into visiting a malicious website, allowing the attacker to take full control of the user's computer. This flaw was actively used by attackers in the wild to install malware and steal data.

Technologies: Microsoft Internet Explorer. Vendors: Microsoft.

Quick answers

Is CVE-2010-0806 exploited in the wild?
Yes. CVE-2010-0806 is known to be exploited in the wild, first recorded on 20 May 2026. Treat it as urgent.
How severe is CVE-2010-0806?
Critical severity, with a CVSS score of 9.3, published 20 May 2026.
Which products and versions are affected?
Microsoft Internet Explorer 6, 6 SP1, 7.
Is there a fix for CVE-2010-0806?
A patch was published on 2010-03-30: Formal patch released via MS10-018 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2010-0806 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2010-0806?
Check whether you run Microsoft Internet Explorer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the Peer Objects component (iepeers.dll) of Microsoft Internet Explorer 6 and 7. The flaw is triggered when the browser attempts to access an invalid pointer after an object has been deleted from memory, often referred to as an 'Uninitialized Memory Corruption Vulnerability.' A remote attacker can exploit this by hosting a specially crafted webpage that, when viewed by a victim, triggers the memory corruption to execute arbitrary code with the privileges of the logged-in user. This vulnerability was notably exploited in the wild starting in March 2010. Microsoft addressed this issue in security bulletin MS10-018.

Affected products

  • Microsoft Internet Explorer 6, 6 SP1, 7

Timeline

  • 2010-03-09: advisory: Initial Microsoft security advisory released
  • 2010-03-11: exploited: Confirmed exploitation in the wild reported
  • 2010-03-30: patched: Formal patch released via MS10-018

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.