Skip to content
Fencer Intel
critical 9.3

CVE-2010-3971 in the critical feed json

Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in…

published 2010-12-22 15 y ago modified 2026-06-16 4 mo ago also EUVD-2010-3948

cvss
9.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
81.7%
EPSS 81.7% chance of exploitation in 30 days, percentile 99.6%
public exploits
4
Metasploit, Exploit-DB

Summary

Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a self-referential @import rule in a stylesheet, aka "CSS Memory Corruption Vulnerability."

Timeline

  1. First public exploit (Metasploit exploit/windows/browser/ms11_003_ie_css_import)
  2. Published

Exploit prediction

81.66% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/windows/browser/ms11_003_ie_css_import MS11-003 Microsoft Internet Explorer CSS Recursive Import Use After Free metasploit exploit, good rank, 2010-11-29
  • EDB-16533 Microsoft Internet Explorer - CSS Recursive Import Use-After-Free (MS11-003) (Metasploit) remote, 2011-02-08
  • EDB-15746 Microsoft Internet Explorer 8 - CSS Parser remote, 2010-12-15
  • EDB-15708 Microsoft Internet Explorer 8 - CSS Parser Denial of Service dos, 2010-12-08
  • breakingpointsystems.com http://www.breakingpointsystems.com/community/blog/ie-vulnerability/ referenced PoC, tagged "exploit" by a source, unverified
  • wooyun.org http://www.wooyun.org/bugs/wooyun-2010-0885 referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2010/Dec/110 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-399 Resource Management Errors

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.