Internet Explorer RCE exploited in the wild (CVE-2010-0806)
CVE-2010-0806
CVE-2010-0806: Internet Explorer 6-7 use-after-free in iepeers.dll grants remote code execution (CVSS 9.3). Update to IE 8 or apply MS10-018.
Actively exploited in the wild - CVE-2010-0806 is a critical use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, and 7 that lets remote attackers execute arbitrary code by accessing an invalid pointer after deleting an object. Exploitation was confirmed in March 2010; apply MS10-018 immediately.
Overview
CVE-2010-0806 is a memory corruption flaw in the Peer Objects component (iepeers.dll) of Microsoft Internet Explorer. When the browser improperly handles a deleted object, an attacker can trigger a use-after-free condition, reusing freed memory to execute malicious code in the context of the logged-on user.
This vulnerability affects IE 6, 6 SP1, and 7 on all supported Windows platforms at the time of disclosure. It was actively exploited in the wild in March 2010, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog.
Impact
An attacker can host a crafted webpage that, when visited by a victim using an affected IE version, executes arbitrary code with the user’s privileges. Full system compromise is possible if the user has administrative rights. The CVSS v2 score of 9.3 (Critical) reflects the low complexity, no privileges required, and network-based attack vector.
Remediation
Microsoft released security bulletin MS10-018 as an out-of-band update in March 2010. The fix is included in Internet Explorer 8 and all subsequent IE versions. To remediate:
- Apply MS10-018 (KB980182) via Windows Update immediately.
- Upgrade to Internet Explorer 8 or later - IE6 and IE7 are end-of-life.
- Block outbound connections to known malicious domains from compromised hosts.
- Enable Enhanced Mitigation Experience Toolkit (EMET) on legacy systems as a defense-in-depth layer.
Security Insight
CVE-2010-0806 was one of the earliest high-profile use-after-free vulnerabilities exploited in the browser ecosystem, setting a precedent for the attack class that would dominate the 2010s. At the time, IE6 remained widely deployed in enterprise environments long after Microsoft had moved on, making this a landmark case study in the risks of outdated software stagnation - a lesson that echoes today in continued exploitation of legacy components like Flash, Java, and old Windows versions.
Related Content
- Weekly Threat Roundup: APT28 DNS Hijacking (Apr 6-12
- APT28 Hijacks SOHO Routers - Microsoft 365 Credentials
- Storm-1175 Exploits Zero-Days to Deploy Medusa
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Metasploit Modules
Weaponized exploit code — authorized use only
The Metasploit Framework modules below are production-ready exploit code maintained by Rapid7. Unlike random GitHub PoCs, these are vetted by Metasploit maintainers and integrated into a point-and-click exploitation framework used by red teams worldwide. The presence of an MSF module means this CVE is trivially exploitable at scale — patch immediately.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| Module | Source |
|---|---|
exploit/windows/browser/ms10_018_ie_behaviors | View source |
1 Metasploit module indexed for this CVE. Source: rapid7/metasploit-framework.
Exploit-DB Entries
Curated public exploit code — authorized use only
The entries below are human-reviewed exploit code hosted on Exploit-DB by Offensive Security. Lower volume than random GitHub PoCs but higher signal: every entry is curated, many are tagged "verified" by the maintainers. Treat as production-ready exploit code.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| EDB-ID | Title | Status |
|---|---|---|
| EDB-11683 | Microsoft Internet Explorer - 'iepeers.dll' Use-After-Free (Metasploit) | verified |
| EDB-16590 | Microsoft Internet Explorer - DHTML Behaviour Use-After-Free (MS10-018) (Metasploit) | verified |
2 Exploit-DB entries indexed for this CVE. Source: Exploit-DB.
Related Advisories
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 20...
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP...
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a craft...
Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)...