CVE-2010-0806 high

Description

Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to KEV: 2026-05-20. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (15)

• NVD reference CISA KEV CVEs
• NVD reference CISA KEV CVEs
• Vendor Advisory CISA KEV CVEs
• Patch, US Government Resource CISA KEV CVEs
• Patch, Vendor Advisory CISA KEV CVEs
• NVD reference CISA KEV CVEs
• US Government Resource CISA KEV CVEs
• US Government Resource CISA KEV CVEs
• Vendor Advisory CISA KEV CVEs
• Vendor Advisory CISA KEV CVEs
• NVD reference CISA KEV CVEs
• NVD reference CISA KEV CVEs
• CISA notes reference CISA KEV CVEs
• NVD detail: CVE-2010-0806 CISA KEV CVEs

  Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

• NVD reference CISA KEV CVEs

• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-20 22:08 UTC
• Microsoft Internet Explorer, Use-After-Free, CVE-2010-0806 (Critical)
  web:dailycve.com

  Protection from this CVE : Apply Microsoft Security Bulletin MS10-018. Enable DEP (Data Execution Prevention) and ASLR where possible. Disable active scripting in Internet Zone or use Enhanced Security Configuration. Upgrade to a newer browser (IE8 or later with protections). Use EMET (Enhanced Mitigation Experience Toolkit) to block use-after-free patterns.

  2026-05-20 22:08 UTC
• Security Update Guide - Microsoft Security Response Center
  web:msrc.microsoft.com

  Security Update Guide - Microsoft Security Response Center

  2026-05-20 22:08 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-05-20 22:08 UTC
• Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
  web:www.bleepingcomputer.com

  Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.

  2026-05-20 22:08 UTC
• CISA adds CVE-2010-0806 to KEV after IE exploits observed in wild
  web:cybersixt.com

  Inclusion in the KEV catalogue indicates that active exploitation of CVE-2010-0806 has been observed in the wild. No public attribution to ransomware campaigns is known at this time. Federal Civilian Executive Branch (FCEB) agencies must apply the required mitigations by the CISA remediation due date of 3 June 2026.

  2026-05-20 22:08 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-05-20 22:08 UTC
• CVE-2010-0806 - Microsoft Internet Explorer Use-After-Free ...
  web:www.scyscan.com

  Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access...

  2026-05-20 22:08 UTC
• CISA Required Action
  CISA KEV (via KEVin)

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-06-03

  2026-05-20 22:08 UTC

Only Available for Registered Users. Sign in to view.