Exploitation Summary
CVE-2010-0806 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 20, 2026.
EIP tracks 3 public exploits from researchers including Metasploit, Trancer, unknown, including a Metasploit module exploits/windows/browser/ms10_018_ie_behaviors.
AI-analyzed exploit summary This is a Metasploit module exploiting a use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 via DHTML behaviors. It achieves remote code execution by manipulating the iepeers.dll component, leveraging heap spraying and JavaScript to trigger the vulnerability.
Description
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
Exploits (3)
This is a Metasploit module exploiting a use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 via DHTML behaviors. It achieves remote code execution by manipulating the iepeers.dll component, leveraging heap spraying and JavaScript to trigger the vulnerability.
This is a Metasploit module exploiting a use-after-free vulnerability in iepeers.dll of Microsoft Internet Explorer 6 and 7. It achieves remote code execution by manipulating memory via JavaScript and triggering the vulnerability through DOM operations.
This Metasploit module exploits a use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 via DHTML behaviors, specifically targeting the iepeers.dll component. It uses heap spraying and JavaScript obfuscation to achieve remote code execution.
References (15)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H