CVE-2013-1347KEV · OVERDUE

Microsoft Internet Explorer Remote Code Execution Vulnerability

High · published May 5, 2013

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.6th percentile for exploit probability.

1675
days past CISA
deadline
CVSS v3.1
8.8
EPSS
78%
Percentile
99.6
In the wild
Confirmed
What it is

🚨 A sneaky memory mishap in Internet Explorer 8 opens the door for attackers to execute arbitrary code remotely. 🔥 Think of it like a restaurant where the staff forgets to properly dispose of expired ingredients — those ingredients can still be served, leading to a disaster in the kitchen! In this case, attackers can exploit this flaw to run malicious code on your system, potentially gaining full control over it. This could mean stealing sensitive data, installing malware, or wreaking havoc on your system's operations. Yikes!

Put simply

Think of it like a restaurant where the staff forgets to properly dispose of expired ingredients — those ingredients can still be served, leading to a disaster in the kitchen! This vulnerability arises from Internet Explorer 8's improper handling of memory objects, allowing attackers to exploit objects that were either not properly allocated or already deleted. When accessed, this can lead to arbitrary code execution, making it a serious threat.

What to do

In this case, attackers can exploit this flaw to run malicious code on your system, potentially gaining full control over it. This could mean stealing sensitive data, installing malware, or wreaking havoc on your system's operations. Yikes! Immediate action is crucial! Users should upgrade to a more secure version of Internet Explorer or switch to a different browser entirely. Additionally, ensure your system is patched with the latest security updates from Microsoft to mitigate this risk. 🛡️ You've got this! By following these steps, you'll strengthen your defenses in no time! ⚡

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.77740 · 99.6th percentile
Published
2013-05-05T10:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 05 MAY 10:00Z
    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that…
    cvelistv5