CVE-2011-1996 Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Co...

HighCVSS 9.3 EPSS 58.8% Framework module Public exploit

Published: 2011-10-12 04:00
Updated: 2026-06-17 02:30
Exploit status: Public exploit available

Description

Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Code Execution Vulnerability."

Affected products

Product	Affected versions	Fixed in
Microsoft internet explorer	= 6	No fix listed
Microsoft internet explorer	= 7	No fix listed
Microsoft internet explorer	= 8	No fix listed

References

MS11-081 patch vendor-advisory
oval:org.mitre.oval:def:12896 signature third-party-advisory vdb-entry

CVSS v2.0

9.3 High

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 58.85% (percentile 99.1)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

MS11-081 Microsoft Internet Explorer Option Element Use-After-Free Framework module · Metasploit Framework (Rapid7) · 2012-10-11
Microsoft Internet Explorer - Option Element Use-After-Free (MS11-081) (Metasploit) Exploit · Exploit Database (OffSec) · 2013-01-10