Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the third entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161103001.html. There you can find a repro that triggered this issue in addition to the information below. Follow me on http://twitter.com/berendjanwever for daily browser bugs. MSIE 10 MSHTML CElement::GetPlainTextInScope out-of-bounds read =============================================================== (The fix and CVE number for this bug are not known) Synopsis -------- An unknown issue in Microsoft Internet Explorer 10 could cause it to read data out-of-bounds. This issue was fixed before I was able to analyze it in detail, hence I did not determine exactly what the root cause was. Known affected software ----------------------- + Internet Explorer 10 An attacker would need to get a target user to open a specially crafted web-page. No special configuration settings are required in order to trigger the issue. No realistic mitigations are known; Javascript is not required to trigger the issue. Description ----------- My fuzzers were using a predecessor of BugId (https://github.com/SkyLined/BugId) to generate a report whenever they found a bug. Unfortunately, this wasn't as sophisticated as BugId is, so the information contained in these report is not as helpful. Still, I saved three reports, for crashes with slightly different stacks. This could have been caused by three different versions of MSIE 10 (every month when Microsoft released a new version with patches, the code may be optimized differently, which could explain these differences). It could also have been caused by the fuzzing framework attempting to reduce the size of the repro by cutting out chunks, which could lead to slightly different code-paths. Unfortunately, I do not know which. Either way, looking at the reports that were automatically generated for this bug (which can be found at the end of this article), one can find the following interesting information on all three: 1) The stack tells us that there was a call to `CTextArea::Notify`, which suggests the one `textarea` element found in the repro is important to triggering the issue. 2) The stack also tells us that there was a call to `CElement::GetPlainTextInScope`, which is commonly used to extract the text inside an element, so the text content in the `textarea` element is probably also important to triggering the issue. Since there is no closing `` tag, this could be all the data in the repro after the opening `