High severity · published Nov 5, 2010
CVE-2010-3962
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
In wildKEV
8.1
CVSS
96.8%
EPSS
Yes
On KEV
Description
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)96.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 6, 2025
Federal remediation dueOct 27, 2025
Ransomware campaign useNot known
Affected products
Which versions
IE
Internet Explorer · Microsoft
6; 7; 8 · source: NVD, KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2010-3962: Microsoft Internet Explorer - Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
IEInternet ExplorerCVE-2010-3962
Oct 6, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3962
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3962
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vdb-entry
http://www.securityfocus.com/bid/44536
third-party-advisory
http://www.us-cert.gov/cas/techalerts/TA10-348A.html
vendor-advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090
third-party-advisory
http://www.kb.cert.org/vuls/id/899748
third-party-advisory
http://secunia.com/advisories/42091
vdb-entry
http://www.vupen.com/english/advisories/2010/2880
More from Internet Explorer
9.8
CVE-2015-0313
Adobe Flash Player Use-After-Free Vulnerability
9.8
CVE-2015-0311
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2014-1776
Microsoft Internet Explorer Memory Corruption Vulnerability
8.8
CVE-2021-27085
Internet Explorer Remote Code Execution Vulnerability
8.8
CVE-2021-26411
Internet Explorer Memory Corruption Vulnerability