CVE-2010-3886
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain...
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
Exploit likelihood
What each source reports
NVD Score used
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
- Record
CVE-2010-3886- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
- Record
CVE-2010-3886- Updated
- 2026-11-02
EUVDEUVD-2010-3864 No score
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
- Record
EUVD-2010-3864- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5jhw-qp9v-79q5 No score
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain...
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
- Record
GHSA-5jhw-qp9v-79q5- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft - 'MSHTML.dll' CTIMEOUTEVENTLIST::INSERTINTOTIMEOUTLIST Memory Leak | 2010-07-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3886 is a medium vulnerability (CVSS 4.3) in Microsoft Internet Explorer, published October 8, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.5%, the 97th percentile. No source names a fixed version.
References
archives.neohapsis.com/archives/bugtraq/2010-06/0259.html
eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker/2010/20100630
twitter.com/WisecWisec/statuses/17254776077
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11606
nvd.nist.gov/vuln/detail/CVE-2010-3886
github.com/advisories/GHSA-5jhw-qp9v-79q5