IE CVE-2010-3962: 2010 Zero-Day Added to KEV in 2025

What to do

1. Search your asset inventory for Windows XP, Server 2003, Vista and Server 2008 machines, and for Windows 7 systems still on IE 8.
2. Replace or upgrade those systems; if one must stay, confirm MS10-090 or a later IE cumulative update is installed.
3. Block legacy machines from browsing the internet and from opening email, and isolate them on their own network segment.
4. Do not treat this listing as a reason to change Edge or IE mode settings on supported Windows; they are not affected.

How to check if you are affected or compromised

• On a legacy host, run reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer" /v Version to see the IE version.
• Run systeminfo and look for KB2416400 or a later IE cumulative update in the hotfix list.
• Review proxy logs for web traffic from hosts that report an MSIE 6.0, 7.0 or 8.0 user agent.

What happened#

In early November 2010, Microsoft disclosed a zero-day in Internet Explorer 6, 7 and 8 that attackers were already using. The CVE record gives a public date of November 2. Microsoft's Security Advisory 2458511 is dated November 3. The CVE record describes a use-after-free tied to CSS token sequences and the clip attribute. Microsoft called it the "Uninitialized Memory Corruption Vulnerability." A crafted web page could run code with the rights of the logged-on user.

The attacks were targeted. Zscaler reported that an email campaign lured victims to a legitimate website that had been compromised. The site checked the browser and served the exploit to IE 6 and 7. Infected machines then fetched further instructions from a server in Poland. The SANS Internet Storm Center later noted that exploit code was public. Microsoft fixed the bug on December 14, 2010 in MS10-090 (KB2416400). That bulletin credits Jose Antonio Vazquez Gonzalez of VeriSign iDefense Labs and confirms "active attacks attempting to exploit the vulnerability."

Almost fifteen years later, on October 6, 2025, CISA added seven CVEs to KEV, this one among them. The batch also included other old bugs from 2010 to 2013 in Mozilla products, Windows and IE. The KEV entry says the product "could be end-of-life" and that "users should discontinue product utilization." CISA did not say whether it saw new activity. The attacks Microsoft documented in 2010 are evidence of exploitation in themselves. No public report of a recent campaign using this bug had been disclosed as of Oct 23, 2026.

Who is affected#

Per MS10-090 and NVD, the affected browsers are IE 6 on Windows XP and Server 2003, and IE 7 on those plus Vista and Server 2008. IE 8 is affected on all of those plus Windows 7 and Server 2008 R2. Microsoft said the IE 9 beta was not affected. CISA scores the bug CVSS 3.1 8.1.

Do you really need to act?#

Almost certainly not. Microsoft's lifecycle FAQ lists IE 9 or IE 11 for every Windows desktop and server release it still covers. It says the IE 11 desktop app went out of support on certain Windows versions on June 15, 2022. The affected list stops at IE 8, and Microsoft points IE users to Edge's IE mode on supported Windows. The bug also needs a user to browse to a malicious page.

The exception is the forgotten box: an XP or Server 2003 machine running a kiosk, lab instrument or plant-floor HMI. Such a machine has missed years of fixes, not just this one. CISA has added several other old IE bugs to KEV in 2024 to 2026, including CVE-2012-4792, CVE-2013-3893, CVE-2010-0249 and CVE-2010-0806. Patching one CVE is not the answer. Isolation and replacement are.

What to do now#

1. Search your inventory for XP, Server 2003, Vista and Server 2008 hosts, and for Windows 7 machines still on IE 8.
2. Replace or upgrade them. If one must stay, confirm that MS10-090 or a later IE cumulative update is installed.
3. Stop legacy hosts from browsing the internet or opening email, and put them on an isolated segment.
4. Do not change Edge or IE mode settings on supported Windows because of this listing.

How to tell if you were hit#

On a legacy host, run reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer" /v Version to read the IE version. Run systeminfo and check the hotfix list for KB2416400 or a later IE update. In proxy logs, look for traffic with MSIE 6.0, 7.0 or 8.0 user agents. Any hit is a machine to investigate and retire.

Timeline#

• Nov 2, 2010 — Public date in the CVE record. Microsoft's advisory follows on November 3.
• Dec 14, 2010 — Microsoft releases MS10-090.
• Jun 15, 2022 — The IE 11 desktop app goes out of support on certain Windows versions.
• Oct 6, 2025 — CISA adds CVE-2010-3962 to KEV.
• Oct 27, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2010-3962 · KEV 2025-10-06 · Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Advisory 2458511: Vulnerability in Internet Explorer Could Allow Remote Code Execution learn.microsoft.com
2. Microsoft — Security Bulletin MS10-090: Cumulative Security Update for Internet Explorer (2416400) learn.microsoft.com
3. CVE record — CVE-2010-3962 cve.org
4. NVD — CVE-2010-3962 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2010-3962 cisa.gov
6. CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog (Oct 6, 2025) cisa.gov
7. Microsoft — Lifecycle FAQ: Internet Explorer and Microsoft Edge learn.microsoft.com
8. Zscaler — Zscaler Provides Protection Against Critical Microsoft Internet Explorer 0day Vulnerability Used in Targeted Attacks zscaler.com
9. SANS Internet Storm Center — Vulnerability in Internet Explorer Could Allow Remote Code Execution (CVE-2010-3962) isc.sans.edu