Microsoft Windows Out-of-Bounds Write Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2013-3918 · Published 12/11/2013 · updated 16/06/2026

Microsoft Windows Out-of-Bounds Write Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 06/10/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
Windows Microsoft	Versions not published yet (product named by CISA KEV)

Description

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."

References

blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx · Third Party Advisory
darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814 · Broken Link
fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.html · Third Party Advisory
us-cert.gov/ncas/alerts/TA13-317A · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090 · Patch
isc.sans.edu/forums/diary/16985 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19089 · Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
microsoft.com/en-us/msrc/blog/2013/11/technical-details-of-the-targeted-attack-using-ie-vulnerability-cve-2013-3918 · Vendor Advisory
CISA KEV · CVE-2013-3918

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free