CVE-2010-3962

microsoft internet explorer

Published 5 Nov 2010 · updated 16 Jun 2026 · Analyzed

8.1 High · CVSS 3.1, CISA ADP

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 6 Oct 2025, with a remediation deadline of 27 Oct 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

References

blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx · Vendor Advisory
secunia.com/advisories/42091 · Broken Link, Vendor Advisory
www.exploit-db.com/exploits/15418 · Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/15421 · Third Party Advisory, VDB Entry
www.kb.cert.org/vuls/id/899748 · Third Party Advisory, US Government Resource
www.microsoft.com/technet/security/advisory/2458511.mspx · Patch, Vendor Advisory
www.securityfocus.com/bid/44536 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id?1024676 · Broken Link, Third Party Advisory, VDB Entry
www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks · Not Applicable
www.us-cert.gov/cas/techalerts/TA10-348A.html · Third Party Advisory, US Government Resource
www.vupen.com/english/advisories/2010/2880 · Broken Link, Vendor Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 · Patch, Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/62962 · Third Party Advisory, VDB Entry
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279 · Tool Signature
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962 · US Government Resource