Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by access…

Published 16 y ago 2009-12-09 · modified 4 mo ago 2026-06-16 · JSON

CVSS

8.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

21.0%

percentile 98%

Public exploits

none known

Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3674.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago 2024-01-11

Exploit prediction (EPSS)

21.04% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	8.1	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	8.1	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	9.3	`AV:N/AC:M/Au:N/C:C/I:C/A:C`

Affected products

microsoft ie

Classification

Weakness

CWE-416 Use After Free
CWE-399 Resource Management Errors

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2009/ms09-072 · vendor-advisory, x_refsource_MS, x_transferred
us-cert.gov /cas/techalerts/TA09-342A.html · third-party-advisory, x_refsource_CERT, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6382 · vdb-entry, signature, x_refsource_OVAL, x_transferred
securitytracker.com /id?1023293 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

CVE List: CVE-2009-3671
NVD: CVE-2009-3671

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary