CVE-2013-3906highunder attackCWE-94

CVE-2013-3906

Published · Updated

Follow this CVE+ Monitor Microsoft Graphics Component

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 85%
from disclosure to weapon27 days
Published on NVDNov 6
1st PoC+27d
metasploitNov 5
CISA KEV+3023d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateSandworm Team🇷🇺 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-08-15

Apply updates per vendor instructions.

In short

A flaw in GDI+ allows attackers to run malicious code by sending a specially crafted TIFF image, often embedded in documents like Word files. This vulnerability was actively exploited in the wild in late 2013.

Technical detail

CWE-94 (Code Injection) in GDI+ image processing across Windows Vista SP2, Server 2008 SP2, and multiple Office versions allows remote code execution when processing malformed TIFF images. Attack vector is remote via document embedding with no user interaction required beyond opening the file; impacts confidentiality, integrity, and availability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.