CVE-2010-0806

Microsoft Internet Explorer contains a use-after-free (resource management) flaw in which the browser accesses an invalid pointer after an object has been deleted, leaving a dangling pointer. A remote attacker can trigger the flaw by luring a user of a vulnerable Internet Explorer version to attacker-controlled or malicious web content; the dangling-pointer access can be leveraged to execute arbitrary code with the victim user's privileges. Any system still running the affected Internet Explorer builds is exposed; the flaw dates to the 2010 era, when vendor advisories (cumulative update MS10-018, March 2010) addressed it in Internet Explorer 6 and 7, and CISA notes the impacted product may be end-of-life. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2026-05-20 (ransomware use unknown), and EPSS assigns an 82.2% probability of exploitation within 30 days; no public proof-of-concept is cataloged.

What to do: Apply mitigations per Microsoft's vendor instructions within the BOD 22-01 timeframe, which for affected builds means the MS10-018 (March 2010) cumulative Internet Explorer update; because IE 6/7 (and IE generally) are end-of-life/retired, CISA also permits discontinuing use of the product. Inventory the estate for Internet Explorer 6/7 on legacy Windows XP and embedded or unmanaged systems, and migrate any remaining users to a supported, currently patched browser rather than relying on the retired IE client.