EXPOSURES › CVE-2013-3918
CVE-2013-3918
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Windows Out-of-Bounds Write Vulnerability allowed remote code execution.
An unpatched out-of-bounds write vulnerability in Microsoft Windows allowed remote code execution, impacting end-of-life products. Users were advised to stop using the affected software.
Shame score — Critical vulnerability actively exploited on end-of-life products.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |