CVE-2010-0806
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft...
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
Exploit likelihood
What each source reports
CVE List
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
- Record
CVE-2010-0806- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2010-0832
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
- Record
EUVD-2010-0832- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f5rx-x946-jm33
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft...
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
- Record
GHSA-f5rx-x946-jm33- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Record
CVE-2010-0806- Weakness
- CWE-399
- Updated
- 2026-11-02
NVD
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
- Record
CVE-2010-0806- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399, CWE-416
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free | 2010-03-09 |
| Exploit-DB | Microsoft Internet Explorer - 'iepeers.dll' Use-After-Free (Metasploit) | 2010-03-10 |
| Exploit-DB | Microsoft Internet Explorer - DHTML Behaviour Use-After-Free (MS10-018) (Metasploit) | 2010-12-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0806 is a high vulnerability (CVSS 9.3) in Microsoft Internet Explorer, published March 10, 2010. CISA lists it as known to be exploited, since May 20, 2026. EUVD reports exploitation since May 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.1%, the 99th percentile. No source names a fixed version.
References
osvdb.org/62810
us-cert.gov/cas/techalerts/TA10-089A.html
securityfocus.com/bid/38615
vupen.com/english/advisories/2010/0567
secunia.com/advisories/38860
Show 11 moreShow less
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018
microsoft.com/technet/security/advisory/981374.mspx
exchange.xforce.ibmcloud.com/vulnerabilities/56772
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446
blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx
kb.cert.org/vuls/id/744549
learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806
nvd.nist.gov/vuln/detail/CVE-2010-0806
github.com/advisories/GHSA-f5rx-x946-jm33