[KEV] CVE-2010-0249 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2010-0249 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2010-0249 is a use-after-free vulnerability in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code through a maliciously crafted web page.

Technical Detail

The flaw occurs when Internet Explorer accesses a memory pointer associated with an object that has already been freed, creating a use-after-free condition. An attacker can exploit this by luring a target user to a specially crafted webpage that triggers the invalid pointer dereference, allowing the attacker to control execution flow. Successful exploitation results in remote code execution (RCE) in the context of the logged-in user, which can lead to full system compromise if the user has administrative privileges.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities catalog on May 20, 2026. The exploit maturity is rated Operational, meaning reliable exploit code capable of consistent, real-world use exists and has been observed in active attack scenarios. This is not limited to proof-of-concept demonstrations.

Who Is Targeting This

No specific threat actor attribution is confirmed at this time. Given the age of the vulnerability and the end-of-life status of the affected product, exploitation is likely opportunistic, targeting organizations that have not retired legacy Internet Explorer deployments.

What To Do

Microsoft Internet Explorer is end-of-life and end-of-service, meaning no further security patches will be issued. Per CISA's Known Exploited Vulnerabilities catalog, organizations should discontinue use of Internet Explorer immediately and migrate to a supported browser. CISA's binding directive requires federal agencies to remediate or apply mitigations by the applicable KEV deadline. For any environment still running Internet Explorer, immediate decommissioning is the only fully effective mitigation. Detection efforts should focus on identifying any remaining Internet Explorer processes in the environment and reviewing web proxy logs for legacy user-agent strings associated with Internet Explorer.