Microsoft Internet Explorer 10 suffers from a MSHTML CElement::GetPlainTextInScope out-of-bounds read vulnerability.