CVE-2010-3886
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the...
- Published
- Oct 8, 2010
- Updated
- Aug 7, 2024
- Assigning CNA
- mitre
- Evidence observed
- Jul 9, 2010
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:M/Au:N/C:P/I:N/A:NModerate · next 30 days
- Percentile
- 96.9%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
Sources
1Ruben Santamarta · windows · Jul 9, 2010
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.