CVE-2013-1347

Microsoft Internet Explorer's CVE-2013-1347 allows remote code execution via memory corruption, a flaw actively exploited in the wild despite the product being end-of-life.

This vulnerability enables attackers to execute arbitrary code in the context of the current user within Internet Explorer, posing a severe risk to systems still running the discontinued browser. DIB organizations must ensure no legacy IE instances remain in production, as reliance on unsupported software violates NIST 800-171 requirements for managing known vulnerabilities and software lifecycles. Immediate remediation involves decommissioning IE and enforcing modern, supported browsers to prevent exploitation of this and similar unpatched flaws.

Shame score — Microsoft shipped a critical RCE flaw in a widely deployed product for years without adequate patching or deprecation warnings, and the product remained in use long past its safe lifecycle, demonstrating severe negligence in software lifecycle management.