CVE-2013-3893highunder attackCWE-416

CVE-2013-3893

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 8.8epss 88%
from disclosure to weapon14 days
Published on NVDSep 18
1st PoC+14d
metasploitSep 17
CISA KEV+4346d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAxiom🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2025-09-02

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Internet Explorer has a bug where malicious websites can run harmful code on your computer by using specially crafted JavaScript. This happens because the browser doesn't properly manage memory when handling mouse capture, allowing attackers to access areas of memory that have already been freed.

Technical detail

Use-after-free vulnerability in mshtml.dll's SetMouseCapture implementation allows remote code execution when processing crafted JavaScript. Exploitation leverages ms-help: URLs to trigger hxds.dll loading, enabling arbitrary code execution in the context of the IE process without user interaction beyond visiting a malicious page.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.