CVE-2013-3163
Microsoft Internet Explorer Memory Corruption Vulnerability
Description
CVE-2013-3163 is a memory corruption vulnerability in Microsoft Internet Explorer versions 8 through 10 that allows remote attackers to execute arbitrary code or cause a denial of service. The flaw, classified as an out-of-bounds write weakness, is triggered when a user visits a specially crafted web page, enabling attackers to gain complete control over the affected system. CVE-2013-3163 has been listed in CISA's Known Exploited Vulnerabilities catalog, confirming active real-world exploitation of this Internet Explorer memory corruption issue. With an EPSS score of 0.85 (99th percentile), this vulnerability remains a significant threat for any environment still running legacy versions of Internet Explorer.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 8; 9; 10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.us-cert.gov/ncas/alerts/TA13-190A(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17363(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3163(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In the context of CVE-2013-3163, Internet Explorer improperly handles objects in memory when rendering crafted web content, leading to an out-of-bounds write condition. This memory corruption flaw allows an attacker to write data beyond the allocated buffer, potentially overwriting critical control structures and hijacking program execution to run arbitrary code.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2013-3163 is remotely exploitable without physical access and requires no authentication, though the victim must be tricked into visiting a malicious website for the attack to succeed. With a CVSS score of 8.8 (HIGH), successful exploitation results in high impact to confidentiality, integrity, and availability — an attacker can execute arbitrary code with the privileges of the current user, potentially gaining full control over the compromised system, stealing sensitive data, or causing a complete denial of service. The EPSS score of 0.85 (99th percentile) indicates a very high likelihood of exploitation, and the vulnerability has been confirmed as actively exploited in the wild. Organizations still running Internet Explorer 8, 9, or 10 face serious risk of complete system compromise through drive-by download attacks leveraging this memory corruption flaw.
Exploit Maturity
Active exploitation of CVE-2013-3163 has been confirmed by CISA, which included this vulnerability in its Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023. The EPSS score of 0.85 (99th percentile) reflects the mature exploit landscape for this Internet Explorer vulnerability. The US-CERT issued alert TA13-190A documenting the threat, and the long availability of this vulnerability since 2013 means exploit techniques are well-established and widely documented in the security community.
Remediation
- Apply the Microsoft security update MS13-055 as referenced in the Microsoft Security Bulletin, or discontinue use of the affected product if mitigations are unavailable.
- Upgrade or migrate away from Internet Explorer versions 8 through 10 entirely. Microsoft has ended support for these legacy browser versions, and users should transition to a modern, supported browser such as Microsoft Edge or another current alternative.
- Implement network-level protections such as web content filtering and proxy-based inspection to block access to known malicious domains that serve exploit kits targeting Internet Explorer memory corruption vulnerabilities.
- Monitor endpoint detection logs for indicators of exploitation including unexpected child processes spawned by iexplore.exe, anomalous memory access patterns, and connections to suspicious command-and-control infrastructure.
- Enforce the principle of least privilege for all user accounts — ensure that users browsing the web do not operate with administrative privileges, which limits the impact of successful code execution through browser vulnerabilities.
Technical Details
CVE-2013-3163 is rooted in an out-of-bounds write vulnerability (CWE-787) within the rendering engine of Microsoft Internet Explorer versions 8 through 10. When processing specially crafted HTML content, the browser mishandles memory objects, writing data beyond the bounds of an allocated buffer, which corrupts adjacent memory structures. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that the attack is network-delivered with low complexity and no privileges required, though user interaction is necessary in the form of visiting a malicious page. The scope remains unchanged, meaning the impact is confined to the Internet Explorer process and its host system, but with high impacts across all three CIA triad dimensions, a successful exploit grants the attacker arbitrary code execution at the privilege level of the logged-in user. This vulnerability is distinct from CVE-2013-3144 and CVE-2013-3151, which address separate memory corruption issues in the same bulletin.
Frequently Asked Questions
What is CVE-2013-3163?
CVE-2013-3163 is a memory corruption vulnerability in Microsoft Internet Explorer 8 through 10 that allows remote attackers to execute arbitrary code or cause a denial of service when a user visits a malicious web page.
How severe is CVE-2013-3163?
With a CVSS score of 8.8 (HIGH), this vulnerability enables full system compromise including arbitrary code execution with the privileges of the current user. The EPSS score of 0.85 confirms a very high probability of exploitation.
Which versions of Internet Explorer are affected?
Microsoft Internet Explorer versions 8, 9, and 10 are affected by CVE-2013-3163.
Has CVE-2013-3163 been exploited in the wild?
Yes. CISA has confirmed active exploitation by adding this vulnerability to its Known Exploited Vulnerabilities catalog. US-CERT also issued alert TA13-190A addressing this threat.
How can I protect my systems from CVE-2013-3163?
Apply Microsoft security bulletin MS13-055. More importantly, migrate away from Internet Explorer entirely, as these versions are no longer supported by Microsoft and do not receive security updates.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.