CVE-2010-3962 Microsoft Internet Explorer Uninitialized Memory Corruption
Remote attackers can execute arbitrary code via crafted CSS token sequences in Internet Explorer, requiring immediate patching.
- Exploited in the wild
- Since 6 Oct 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-3962?
CVE-2010-3962 is a high-severity use after free vulnerability in Microsoft Internet Explorer, published on 5 Nov 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
Weakness: CWE-416
Which versions are affected by CVE-2010-3962?
It affects 1 product.
Products include Microsoft Internet Explorer.
How do I fix CVE-2010-3962?
No fix has been published for CVE-2010-3962 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 27 Oct 2025.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2010-3962 being exploited?
Yes. Attackers have exploited CVE-2010-3962 in the wild since at least 6 Oct 2025.
Public exploit code: 1 Metasploit module and 3 Exploit-DB entries.
Other vulnerabilities in Microsoft Internet Explorer
- CVE-2014-1776 Microsoft Internet Explorer Memory Corruption
- CVE-2021-27085 Microsoft Internet Explorer Remote Code Execution
- CVE-2017-0222 Microsoft Internet Explorer Remote Code Execution
- CVE-2017-0210 Microsoft Internet Explorer Privilege Escalation
- CVE-2017-0149 Microsoft Internet Explorer Memory Corruption
Sources
Also known as GHSA-cmh7-cfjq-p92g.