This critical use-after-free vulnerability in legacy Microsoft Internet Explorer versions is confirmed to be actively exploited in the wild and poses a significant risk of arbitrary code execution.

This is a use-after-free vulnerability located in the Peer Objects component (iepeers.dll). An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a malicious webpage, leading to arbitrary code execution with the privileges of the victim.

The CVSS score of 9.5 reflects the potential for total system compromise through remote code execution. Because the vulnerability allows attackers to execute code in the context of the user, it can be used to install persistent malware, steal credentials, or pivot deeper into the internal corporate network.

Immediate Action: Apply the security update provided in Microsoft Security Bulletin MS10-018. If the software is no longer required, it should be uninstalled or disabled in favor of a modern, supported browser.

Proactive Monitoring: Review web proxy and firewall logs for traffic directed toward known-malicious domains that host exploit kits targeting legacy browser vulnerabilities.

Compensating Controls: Implement browser isolation technologies or use modern browser versions that include advanced exploit mitigations (e.g., DEP/ASLR) which are absent in these legacy versions.

Public Exploit Available: Yes — weaponized modules exist in both Metasploit and ExploitDB.

Internet Explorer 6 and 7 are end-of-life and inherently insecure. Organizations should prioritize the migration of all users to a modern, supported browser. If legacy applications require these versions, they must be isolated from the general internet to prevent exploitation.