CVE-2013-1347highunder attackCWE-416

CVE-2013-1347

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 78%
from disclosure to weapon2 days
Published on NVDMay 5
1st PoC+2d
metasploitMay 3
CISA KEV+3224d
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

Internet Explorer 8 has a memory handling flaw that lets attackers run malicious code on your computer by tricking the browser into using objects that were improperly created or removed from memory. This vulnerability was actively exploited by criminals in May 2013.

Technical detail

Use-after-free vulnerability (CWE-416) in IE8's object memory management allows remote code execution when attackers craft malicious web content that causes the browser to reference freed or unallocated memory objects. Exploitation requires user interaction (visiting a malicious webpage) and results in arbitrary code execution with user privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.