CVE DatabaseCVE-2013-0074
한국어 권고문 →
CVE-2013-00747.8/HIGHCISA KEV

Microsoft Silverlight Double Dereference Remote Code Execution Vulnerability (CVE-2013-0074)

⚡ Jump to Patch
Affected Vendors
microsoft
Affected Components
silverlight
Published Date
2013-03-13
CVSS v3.1
7.8
HIGH
EPSS (30d)
78.9%
FIRST.org
CISA KEV
Exploited

Executive & SecOps Summary

SECOPS ASSESSMENT
Affected Scope

Microsoft Silverlight 5 and Silverlight 5 Developer Runtime versions prior to 5.1.20125.0

Impact

Remote attackers can execute arbitrary code with the logged-in user's privileges by enticing users to visit a website containing a specially crafted Silverlight application

Mitigation

Upgrade Microsoft Silverlight to version 5.1.20125.0 or later, or completely uninstall the Silverlight plugin from all endpoints

Affected Products & Version Scope

Microsoft Silverlight 5 and Silverlight 5 Developer Runtime (all versions prior to 5.1.20125.0)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Since Microsoft Silverlight has reached End of Support (EOL), the recommended action is complete removal. If legacy business requirements dictate its temporary retention, ensure it is updated to version 5.1.20125.0 or higher.

Use the following PowerShell script to audit and silently uninstall Silverlight from Windows endpoints:

powershell
# Audit Silverlight installation and version
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -like '*Silverlight*' } | Select-Object DisplayName, DisplayVersion, UninstallString

# Silently uninstall Silverlight
$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*Silverlight*' }
if ($app) {
    Write-Host 'Uninstalling Microsoft Silverlight...'
    $app.Uninstall()
    Write-Host 'Uninstall completed successfully.'
} else {
    Write-Host 'Microsoft Silverlight is not installed.'
}

2. Temporary Workaround & Hardening Configuration

If immediate uninstallation is not feasible, restrict the Silverlight ActiveX control from running in web browsers by setting the ActiveX Kill-Bit via the registry.

Execute the following commands in an elevated Command Prompt to apply the Kill-Bit:

cmd
:: Set Kill-Bit for Silverlight ActiveX CLSID {DFEAF541-F3E1-4c24-ACAC-99C071D7730A}
reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DFEAF541-F3E1-4c24-ACAC-99C071D7730A}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DFEAF541-F3E1-4c24-ACAC-99C071D7730A}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f

3. Log Audit & IoC Verification Commands

Scan the system for vulnerable Silverlight binaries (agcore.dll) to identify endpoints requiring remediation.

powershell
# Scan and verify agcore.dll version
$targetPaths = @("${env:ProgramFiles}\Microsoft Silverlight", "${env:ProgramFiles(x86)}\Microsoft Silverlight")
foreach ($dir in $targetPaths) {
    $dll = Join-Path $dir 'agcore.dll'
    if (Test-Path $dll) {
        $ver = (Get-Item $dll).VersionInfo.FileVersion
        Write-Host "Detected: $dll [Version: $ver]"
        if ([version]$ver -lt [version]'5.1.20125.0') {
            Write-Warning 'VULNERABLE: Outdated Silverlight binary detected.'
        } else {
            Write-Host 'Secure: Patched version detected.' -ForegroundColor Green
        }
    }
}
Interactive SecOps Remediation Checklist
0/4 (0%)
Recommended Security Control & Mitigation Partner
SentinelOne Singularity AI EDR
Because Microsoft Silverlight is an obsolete technology, we strongly recommend completely removing it from all enterprise systems and migrating to modern HTML5 standards.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2013-0074) is a double dereference vulnerability in Microsoft Silverlight that occurs during the rendering of HTML objects. The root cause lies in the Silverlight runtime's failure to properly validate memory pointers before dereferencing them. When processing specifically structured HTML objects, the rendering engine attempts to access a memory address that has already been freed or is uninitialized, leading to memory corruption.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by hosting a malicious Silverlight application (.xap) on a web server and leveraging social engineering (such as phishing emails or compromised websites) to lure targets to the page. When a victim visits the page using a browser with the vulnerable Silverlight plugin enabled, the application triggers the double dereference flaw. This bypasses the Silverlight sandbox, corrupts the call stack, redirects execution flow to attacker-controlled shellcode, and executes arbitrary commands under the context of the active user.

3. Infrastructure & Business Impact

As a vulnerability listed in the CISA KEV catalog, CVE-2013-0074 has been actively exploited in targeted campaigns. Successful exploitation grants attackers initial access to corporate workstations, enabling them to perform lateral movement, deploy ransomware, or exfiltrate sensitive business data. Leaving legacy Silverlight installations active on enterprise endpoints poses a severe security risk.

Official Vendor Advisories & References

Frequently Asked SecOps Questions (CVE-2013-0074)

FAQ

Q1. How critical is CVE-2013-0074 and is it actively exploited in the wild?

CVE-2013-0074 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 78.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2013-0074?

Primary impacted vendors include microsoft across silverlight. Scope summary: Microsoft Silverlight 5 and Silverlight 5 Developer Runtime (all versions prior to 5.1.20125.0)

Q3. What temporary mitigations or workarounds exist for CVE-2013-0074 before patching?

[Mitigation] Upgrade Microsoft Silverlight to version 5.1.20125.0 or later, or completely uninstall the Silverlight plugin from all endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION

Generate an Internal Engineering Notice or CISO Report for CVE-2013-0074

Instantly format this advisory into an executive CISO summary or engineering patch ticket.

Generate Report →

🔗 Related Advisories in Similar Stack (microsoft)

View Category →
SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed:
PatchKO
CVE-2013-0074 Microsoft Silverlight Double Dereference Remote Code Execution Vulnerability (CVE-2013-0074) (CVSS 7.8) - Patch & Workaround | CVE Pulse