CVE-2013-3918
Microsoft Windows Out-of-Bounds Write Vulnerability
Description
CVE-2013-3918 is a memory corruption vulnerability in the InformationCardSigninHelper Class ActiveX control (icardie.dll) in Microsoft Windows, allowing remote attackers to execute arbitrary code or cause a denial of service through an out-of-bounds write triggered by a crafted web page. This vulnerability affects a wide range of Windows versions from XP SP2 through Windows 8.1 and Server 2012 R2. With an EPSS score of 0.87839 (99.5th percentile) and confirmed active exploitation in the wild as a zero-day, this vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 27, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows 8 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2003 | - |
| microsoft | windows server 2008 | r2; sp2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows vista | - |
| microsoft | windows xp | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx(Third Party Advisory)
- http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814/(Broken Link)
- http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.html(Third Party Advisory)
- http://www.us-cert.gov/ncas/alerts/TA13-317A(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090(Patch, Vendor Advisory)
- https://isc.sans.edu/forums/diary/16985(Third Party Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19089(Broken Link, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3918(US Government Resource)
- https://www.microsoft.com/en-us/msrc/blog/2013/11/technical-details-of-the-targeted-attack-using-ie-vulnerability-cve-2013-3918/(Vendor Advisory)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 is a broad category encompassing vulnerabilities where software performs operations on a memory buffer without properly ensuring that the read or write operations stay within the buffer's intended boundaries. In CVE-2013-3918, the ActiveX control fails to properly validate input, leading to memory operations that exceed buffer limits. This class of vulnerability can result in crashes, data corruption, or arbitrary code execution depending on what memory regions are affected.
CWE-787: Out-of-bounds Write
CWE-787 is a more specific subtype of CWE-119 that describes conditions where software writes data past the end or before the beginning of an allocated buffer. In CVE-2013-3918, the InformationCardSigninHelper ActiveX control writes beyond the boundaries of an allocated memory region when processing crafted input, enabling an attacker to corrupt adjacent memory and potentially redirect execution flow. Out-of-bounds writes are among the most dangerous memory corruption vulnerabilities because they can be reliably exploited for code execution.
Impact Analysis
The business impact of CVE-2013-3918 is critical as it enables remote code execution through a browser-based attack vector, potentially compromising any system whose user visits a malicious webpage. Confidentiality Impact is high because successful exploitation grants the attacker code execution with the privileges of the current user, enabling access to all data, documents, credentials, and network resources available to that user. Integrity Impact is high since the attacker can install malware, create backdoor accounts, modify system files, and alter security configurations. Availability Impact is high as the exploit can crash the browser and the attacker can install software that degrades or disables system functionality. The attack is network-based (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), though user interaction (UI:R) is needed in the form of visiting a malicious webpage. The EPSS score of 0.87839 (99.5th percentile) indicates near-certain exploitation. This vulnerability was exploited as a zero-day in watering hole attacks, where threat actors compromised legitimate websites frequented by targeted organizations. The KEV catalog listing with ransomware status "Unknown" underscores the ongoing relevance of this vulnerability for organizations maintaining legacy Windows systems.
Exploit Maturity
CVE-2013-3918 has a fully mature and confirmed exploitation history. This vulnerability was exploited as a zero-day in watering hole attacks discovered by FireEye in November 2013, prior to the availability of a Microsoft patch. The attack campaigns targeted specific organizations by compromising websites they frequently visited, injecting exploit code that triggered the ActiveX control vulnerability. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 27, 2025, and ransomware association is listed as "Unknown." The EPSS score of 0.87839 (99.5th percentile) reflects the extremely high probability of exploitation. Microsoft acknowledged the active exploitation in their MSRC blog post and released security bulletin MS13-090 to address it. The US-CERT issued alert TA13-317A documenting the threat. The SANS Internet Storm Center also published analysis of the vulnerability. The well-documented exploitation history and availability of attack techniques make this a high-confidence exploitation risk.
Remediation
- Apply Microsoft security bulletin MS13-090. Install the security update that sets the kill bit for the InformationCardSigninHelper Class ActiveX control, preventing Internet Explorer from loading the vulnerable icardie.dll component. The patch is available through the Microsoft Security Bulletin MS13-090.
- Migrate off legacy Windows and Internet Explorer. All Windows versions affected by CVE-2013-3918 (XP, Server 2003, Vista, Server 2008, Windows 7, Windows 8/8.1, Server 2012) are either end-of-life or nearing it. Upgrade to Windows 10 or Windows 11 and use a modern browser such as Microsoft Edge to eliminate the ActiveX attack surface entirely.
- Disable ActiveX controls in Internet Explorer. If legacy Internet Explorer usage is required, configure Group Policy to disable ActiveX controls in the Internet and Restricted Sites zones. Set the "Run ActiveX controls and plug-ins" setting to "Disable" to prevent exploitation of this and similar ActiveX vulnerabilities.
- Set the kill bit for the vulnerable ActiveX control. Manually set the kill bit for the CLSID associated with the InformationCardSigninHelper Class ActiveX control to prevent it from being instantiated in Internet Explorer, even without applying the full security update. This provides an immediate mitigation while scheduling the full patch deployment.
- Deploy Enhanced Mitigation Experience Toolkit (EMET). On systems that cannot be immediately patched or upgraded, deploy EMET or Windows Defender Exploit Guard with DEP, ASLR, and EAF mitigations enabled for Internet Explorer to reduce the likelihood of successful exploitation.
Technical Details
The CVSS v3.1 vector for CVE-2013-3918 is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a score of 8.8 (High). Attack Vector (AV:N) is network, indicating remote exploitation over the internet is possible by directing a user to a malicious website. Attack Complexity (AC:L) is low, meaning the exploit is reliable and does not depend on race conditions or unusual system configurations. Privileges Required (PR:N) is none, as no authentication is needed. User Interaction (UI:R) is required, as the victim must visit a webpage that instantiates the malicious ActiveX control. Scope (S:U) is unchanged, confining the impact to the user's security context. All three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high.
The vulnerability exists in the InformationCardSigninHelper Class ActiveX control implemented in icardie.dll, which is part of the Windows CardSpace (formerly InfoCard) identity management system. The ActiveX control is marked as "safe for scripting," meaning Internet Explorer allows web pages to instantiate and interact with it without user prompts. The out-of-bounds write occurs when the control processes specially crafted parameters passed from a webpage through JavaScript. The attacker crafts a webpage that instantiates the ActiveX control using its CLSID and passes malformed data that causes the control to write beyond the bounds of an allocated buffer. By carefully controlling the write size and content, the attacker can overwrite adjacent memory structures, typically targeting virtual function table pointers or other code pointers. The corrupted pointer is then dereferenced during normal program execution, redirecting control flow to attacker-supplied shellcode. The zero-day exploitation in watering hole attacks demonstrated that threat actors could reliably achieve code execution across multiple Windows versions using this technique.
Frequently Asked Questions
What is the InformationCardSigninHelper ActiveX control?
The InformationCardSigninHelper Class ActiveX control is a component of Windows CardSpace (formerly known as InfoCard), an identity metasystem for managing digital identities. Implemented in icardie.dll, this control facilitates identity card sign-in operations within Internet Explorer. Because it was marked as "safe for scripting," any web page could instantiate and interact with it, creating a broad attack surface.
How was CVE-2013-3918 exploited in the wild?
CVE-2013-3918 was exploited through watering hole attacks, where threat actors compromised legitimate websites visited by targeted organizations and injected exploit code. When victims visited the compromised sites using Internet Explorer, the malicious page silently instantiated the vulnerable ActiveX control and triggered the out-of-bounds write to execute arbitrary code, all without any visible indication to the user.
Which systems are affected by CVE-2013-3918?
The vulnerability affects Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows RT. All of these systems are now end-of-life or legacy platforms that should be migrated to modern supported Windows versions.
Does CVE-2013-3918 affect modern Windows versions?
No, CVE-2013-3918 does not affect Windows 10 or later. The vulnerable ActiveX control is part of the legacy Windows CardSpace system, which was deprecated and removed in newer Windows versions. Additionally, modern browsers like Microsoft Edge do not support ActiveX controls, eliminating this entire attack surface.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.