CVE-2010-3962
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers...
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
Exploit likelihood
What each source reports
CVE List
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
- Record
CVE-2010-3962- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2010-3939
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
- Record
EUVD-2010-3939- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cmh7-cfjq-p92g
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers...
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
- Record
GHSA-cmh7-cfjq-p92g- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Record
CVE-2010-3962- Updated
- 2026-11-02
NVD
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
- Record
CVE-2010-3962- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption | 2010-11-03 |
| Exploit-DB | Microsoft Internet Explorer - Memory Corruption | 2010-11-04 |
| Exploit-DB | Microsoft Internet Explorer 6/7/8 - Memory Corruption | 2010-11-04 |
| Exploit-DB | Microsoft Internet Explorer - CSS SetUserClip Memory Corruption (MS10-090) (Metasploit) | 2011-01-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3962 is a high vulnerability (CVSS 9.3) in Microsoft Internet Explorer, published November 5, 2010. CISA lists it as known to be exploited, since October 6, 2025. EUVD reports exploitation since October 6, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.8%, the 99th percentile. No source names a fixed version.
References
securityfocus.com/bid/44536
us-cert.gov/cas/techalerts/TA10-348A.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090
kb.cert.org/vuls/id/899748
secunia.com/advisories/42091
vupen.com/english/advisories/2010/2880
Show 11 moreShow less
microsoft.com/technet/security/advisory/2458511.mspx
securitytracker.com/id?1024676
exploit-db.com/exploits/15421
symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks
exchange.xforce.ibmcloud.com/vulnerabilities/62962
blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962
nvd.nist.gov/vuln/detail/CVE-2010-3962
github.com/advisories/GHSA-cmh7-cfjq-p92g