CVE-2010-0248 — Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability."

Back Back to CVE browser

HIGH

Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability."

Published Jan 22, 2010

8.1

HIGH

CVSS 3.1

EPSS 53.09%

Description

Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability."

Affected products

Vendor Microsoft Product IE Default
n/a
- Version
  6
  Status
  affected
  Constraints
  -
- Version
  6 SP1
  Status
  affected
  Constraints
  -
- Version
  7
  Status
  affected
  Constraints
  -
- Version
  8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

n/a

Version	Status	Constraints
6	affected	-
6 SP1	affected	-
7	affected	-
8	affected	-

Remediation

No remediation recorded yet.

Metrics

53.09% 0.53085

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.53085

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (19 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	53.09% (0.53085)	98.95th	v5 (v2026.06.15)
Jun 15, 2026	53.09% (0.53085)	98.84th	v5 (v2026.06.15)
Dec 28, 2025	78.38% (0.78378)	98.98th	v4 (v2025.03.14)
Dec 27, 2025	80.24% (0.80239)	99.08th	v4 (v2025.03.14)
Oct 28, 2025	78.38% (0.78378)	98.98th	v4 (v2025.03.14)
Oct 27, 2025	80.24% (0.80239)	99.07th	v4 (v2025.03.14)
Oct 1, 2025	78.38% (0.78378)	99.00th	v4 (v2025.03.14)
Mar 30, 2025	80.24% (0.80239)	99.07th	v4 (v2025.03.14)
Mar 29, 2025	81.37% (0.81371)	98.94th	v4 (v2025.03.14)
Mar 17, 2025	80.24% (0.80239)	99.07th	v4 (v2025.03.14)
Dec 12, 2024	97.25% (0.97254)	99.89th	v3 (v2023.03.01)
Jun 10, 2024	97.32% (0.97321)	99.88th	v3 (v2023.03.01)
Mar 11, 2024	97.24% (0.97243)	99.83th	v3 (v2023.03.01)
Sep 15, 2023	97.28% (0.97275)	99.78th	v3 (v2023.03.01)
Aug 3, 2023	97.34% (0.97344)	99.82th	v3 (v2023.03.01)
May 8, 2023	97.25% (0.97253)	99.73th	v3 (v2023.03.01)
Mar 7, 2023	97.31% (0.97307)	99.74th	v3 (v2023.03.01)
Mar 6, 2023	89.68% (0.89677)	99.83th	v2 (v2022.01.01)
Feb 4, 2022	89.68% (0.89677)	99.80th	v2 (v2022.01.01)

Weaknesses (2)

CWE-416

Use After Free

CWE-94

Code Injection

References (3)

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002
vendor-advisoryx_refsource_MS
https://exchange.xforce.ibmcloud.com/vulnerabilities/55778
vdb-entryx_refsource_XF
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8267
vdb-entrysignaturex_refsource_OVAL

Link	Providers	Tags
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002		vendor-advisoryx_refsource_MS
https://exchange.xforce.ibmcloud.com/vulnerabilities/55778		vdb-entryx_refsource_XF
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8267		vdb-entrysignaturex_refsource_OVAL