Microsoft Silverlight Double Dereference Remote Code Execution Vulnerability (CVE-2013-0074)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Silverlight 5 and Silverlight 5 Developer Runtime versions prior to 5.1.20125.0
Remote attackers can execute arbitrary code with the logged-in user's privileges by enticing users to visit a website containing a specially crafted Silverlight application
Upgrade Microsoft Silverlight to version 5.1.20125.0 or later, or completely uninstall the Silverlight plugin from all endpoints
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Since Microsoft Silverlight has reached End of Support (EOL), the recommended action is complete removal. If legacy business requirements dictate its temporary retention, ensure it is updated to version 5.1.20125.0 or higher.
Use the following PowerShell script to audit and silently uninstall Silverlight from Windows endpoints:
# Audit Silverlight installation and version
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -like '*Silverlight*' } | Select-Object DisplayName, DisplayVersion, UninstallString
# Silently uninstall Silverlight
$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*Silverlight*' }
if ($app) {
Write-Host 'Uninstalling Microsoft Silverlight...'
$app.Uninstall()
Write-Host 'Uninstall completed successfully.'
} else {
Write-Host 'Microsoft Silverlight is not installed.'
}2. Temporary Workaround & Hardening Configuration
If immediate uninstallation is not feasible, restrict the Silverlight ActiveX control from running in web browsers by setting the ActiveX Kill-Bit via the registry.
Execute the following commands in an elevated Command Prompt to apply the Kill-Bit:
:: Set Kill-Bit for Silverlight ActiveX CLSID {DFEAF541-F3E1-4c24-ACAC-99C071D7730A}
reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DFEAF541-F3E1-4c24-ACAC-99C071D7730A}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DFEAF541-F3E1-4c24-ACAC-99C071D7730A}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f3. Log Audit & IoC Verification Commands
Scan the system for vulnerable Silverlight binaries (agcore.dll) to identify endpoints requiring remediation.
# Scan and verify agcore.dll version
$targetPaths = @("${env:ProgramFiles}\Microsoft Silverlight", "${env:ProgramFiles(x86)}\Microsoft Silverlight")
foreach ($dir in $targetPaths) {
$dll = Join-Path $dir 'agcore.dll'
if (Test-Path $dll) {
$ver = (Get-Item $dll).VersionInfo.FileVersion
Write-Host "Detected: $dll [Version: $ver]"
if ([version]$ver -lt [version]'5.1.20125.0') {
Write-Warning 'VULNERABLE: Outdated Silverlight binary detected.'
} else {
Write-Host 'Secure: Patched version detected.' -ForegroundColor Green
}
}
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2013-0074) is a double dereference vulnerability in Microsoft Silverlight that occurs during the rendering of HTML objects. The root cause lies in the Silverlight runtime's failure to properly validate memory pointers before dereferencing them. When processing specifically structured HTML objects, the rendering engine attempts to access a memory address that has already been freed or is uninitialized, leading to memory corruption.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by hosting a malicious Silverlight application (.xap) on a web server and leveraging social engineering (such as phishing emails or compromised websites) to lure targets to the page. When a victim visits the page using a browser with the vulnerable Silverlight plugin enabled, the application triggers the double dereference flaw. This bypasses the Silverlight sandbox, corrupts the call stack, redirects execution flow to attacker-controlled shellcode, and executes arbitrary commands under the context of the active user.
3. Infrastructure & Business Impact
As a vulnerability listed in the CISA KEV catalog, CVE-2013-0074 has been actively exploited in targeted campaigns. Successful exploitation grants attackers initial access to corporate workstations, enabling them to perform lateral movement, deploy ransomware, or exfiltrate sensitive business data. Leaving legacy Silverlight installations active on enterprise endpoints poses a severe security risk.
Official Vendor Advisories & References
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
Frequently Asked SecOps Questions (CVE-2013-0074)
FAQQ1. How critical is CVE-2013-0074 and is it actively exploited in the wild?
CVE-2013-0074 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 78.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2013-0074?
Primary impacted vendors include microsoft across silverlight. Scope summary: Microsoft Silverlight 5 and Silverlight 5 Developer Runtime (all versions prior to 5.1.20125.0)
Q3. What temporary mitigations or workarounds exist for CVE-2013-0074 before patching?
[Mitigation] Upgrade Microsoft Silverlight to version 5.1.20125.0 or later, or completely uninstall the Silverlight plugin from all endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2013-0074
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory
[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.