CVE-2013-0074

A double dereference vulnerability in Microsoft Silverlight allowed remote attackers to execute code via crafted HTML objects.

Microsoft Silverlight failed to validate pointers during HTML object rendering, enabling remote code execution. DIB organizations must care because this unpatched, actively exploited flaw was linked to ransomware campaigns, demonstrating how legacy components can become critical attack vectors. Organizations should ensure all legacy runtimes are patched or disabled, and monitor for similar unpatched vulnerabilities in their supply chain.

Shame score — A known, actively exploited vulnerability in a legacy component was left unpatched and was directly linked to ransomware attacks, showing severe negligence in maintaining critical infrastructure.