[KEV] CVE-2010-0806 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2010-0806 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2010-0806 is a use-after-free vulnerability in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code by manipulating object deletion and subsequent invalid pointer access.

Technical Detail

The flaw occurs when Internet Explorer accesses a memory pointer after the underlying object has been freed, a classic use-after-free condition that corrupts heap memory in a manner an attacker can influence. An attacker can trigger this remotely by directing a target user to a specially crafted web page, requiring no authentication and minimal user interaction beyond visiting the malicious content. Successful exploitation results in remote code execution in the context of the logged-in user, which can lead to full system compromise if the user has administrative privileges.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities catalog on May 20, 2026. The exploit maturity is rated Operational, meaning functional exploit code capable of reliable exploitation exists and has been observed in use against real targets, not merely as a proof-of-concept demonstration.

Who Is Targeting This

No specific threat actor attribution is confirmed at this time. The absence of attribution data does not diminish the risk given confirmed active exploitation and the broad historical attack surface of Internet Explorer.

What To Do

Microsoft Internet Explorer is considered end-of-life and end-of-service; Microsoft has ceased security updates for the product. Per CISA's Known Exploited Vulnerabilities directive, organizations should patch or apply mitigations by the required deadline, however the primary recommended action is to discontinue all use of Internet Explorer immediately and migrate to a supported browser. Organizations still running Internet Explorer in any capacity, including enterprise legacy application compatibility modes, should treat this as an urgent remediation priority. Detection efforts should focus on identifying any remaining Internet Explorer processes in the environment and reviewing web proxy logs for iexplore.exe activity.