Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to…

1. 2009-02-10 First public exploit (Metasploit exploit/windows/browser/ms09_002_memory_corruption)
2. 2009-02-10 Published

84.64% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/browser/ms09_002_memory_corruption MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption metasploit exploit, normal rank, 2009-02-10
• EDB-16555 Microsoft Internet Explorer 7 - CFunctionPointer Uninitialized Memory Corruption (MS09-002) (Metasploit) remote, 2010-07-12
• EDB-8152 Microsoft Internet Explorer 7 - Memory Corruption (MS09-002) remote, 2009-03-04
• EDB-8082 Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (MS09-002) remote, 2009-02-20
• EDB-8080 Microsoft Internet Explorer 7 - Memory Corruption (MS09-002) remote, 2009-02-20
• EDB-8079 Microsoft Internet Explorer 7 (Windows XP SP2) - Memory Corruption (MS09-002) remote, 2009-02-20
• EDB-8077 Microsoft Internet Explorer 7 - Memory Corruption (PoC) (MS09-002) dos, 2009-02-18

Weakness

• CWE-399 Resource Management Errors

• docs.microsoft.com /en-us/security-updates/securitybulletins/2009/ms09-002

  vendor-advisory, patch

• exploit-db.com /exploits/8082

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/8079

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/8080

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/8077

  exploit, third-party-advisory, vdb-entry

• vupen.com /english/advisories/2009/0389

  vdb-entry, vendor-advisory

• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6000

  vdb-entry, signature, third-party-advisory

• zerodayinitiative.com /advisories/ZDI-09-011/

  third-party-advisory, vdb-entry

• securityfocus.com /bid/33627

  vdb-entry, third-party-advisory

• osvdb.org /51839

  vdb-entry, broken-link

• us-cert.gov /cas/techalerts/TA09-041A.html

  third-party-advisory, us-government-resource

• CVE List CVE-2009-0075
• NVD CVE-2009-0075

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.