CVE DatabaseCVE-2013-3918

Updated 2026-06-16한국어 권고문 →

CVE-2013-39188.8/HIGHCISA KEVCWE-787CWE-787

Microsoft Internet Explorer ActiveX Control (icardie.dll) Out-of-Bounds Write Remote Code Execution Vulnerability (CVE-2013-3918)

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

windows, internet_explorer

Published Date

2013-11-12

CVSS v3.1

8.8

HIGH

EPSS (30d)

73.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012

Impact

Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page

Mitigation

Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry

Affected Products & Version Scope

Internet Explorer on Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 Gold/R2

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Deploy the official Microsoft MS13-090 security update. For legacy systems, you can force the installation of the corresponding KB update using PowerShell:

powershell

# Install the required security update via PSWindowsUpdate module
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB2900986 -Install -AcceptAll -AutoReboot

2. Temporary Workaround & Hardening Configuration

If patching cannot be immediately applied, disable the vulnerable ActiveX control by setting the Kill Bit in the Windows Registry:

powershell

# Set ActiveX Kill Bit for InformationCardSigninHelper (CLSID: {149C314F-2E7E-418E-B08F-C258583B1942})
$registryPath = 'HKLM:\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{149C314F-2E7E-418E-B08F-C258583B1942}'
if (!(Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force
}
New-ItemProperty -Path $registryPath -Name 'Compatibility Flags' -Value 1024 -PropertyType DWord -Force

# Apply for 32-bit IE on 64-bit Windows (WOW64)
$wow64Path = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{149C314F-2E7E-418E-B08F-C258583B1942}'
if (!(Test-Path $wow64Path)) {
    New-Item -Path $wow64Path -Force
}
New-ItemProperty -Path $wow64Path -Name 'Compatibility Flags' -Value 1024 -PropertyType DWord -Force

3. Log Audit & IoC Verification Commands

Verify the version of icardie.dll on the system to determine if the system remains unpatched:

powershell

# Check the file version of icardie.dll
$dllPath = "$env:SystemRoot\System32\icardie.dll"
if (Test-Path $dllPath) {
    $fileVersion = (Get-Item $dllPath).VersionInfo.FileVersion
    Write-Host "Current icardie.dll version: $fileVersion"
} else {
    Write-Host "icardie.dll is not present on this system."
}

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Immediately apply the MS13-090 security update or configure the registry Kill Bit to prevent exploitation of this active zero-day vulnerability.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2013-3918) is an out-of-bounds write (CWE-787) vulnerability within the InformationCardSigninHelper class ActiveX control in icardie.dll on Microsoft Windows. The root cause lies in the insufficient validation of input data size when Internet Explorer instantiates and processes the ActiveX control, leading to memory corruption in the heap.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by hosting a malicious web page containing crafted HTML and JavaScript. When a user visits the site using Internet Explorer, the browser loads the vulnerable ActiveX control. This triggers an out-of-bounds write, allowing the attacker to corrupt memory structures, bypass security mitigations (often combined with heap spraying), hijack the execution flow, and execute arbitrary shellcode. This vulnerability was actively exploited in the wild as a zero-day in watering hole attacks.

3. Infrastructure & Business Impact

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the active user. If the victim is logged in with administrative rights, the attacker can gain complete control of the affected system, install unauthorized programs, view or modify sensitive data, and establish a persistent foothold within the enterprise network.

Official Vendor Advisories & References

NVD Original English Description

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."

http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx

Source: secure@microsoft.com · Third Party Advisory

http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814/

Source: secure@microsoft.com · Broken Link

http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.html

Source: secure@microsoft.com · Third Party Advisory

http://www.us-cert.gov/ncas/alerts/TA13-317A

Source: secure@microsoft.com · Third Party Advisory, US Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090

Source: secure@microsoft.com · Patch, Vendor Advisory

https://isc.sans.edu/forums/diary/16985

Source: secure@microsoft.com · Third Party Advisory

Frequently Asked SecOps Questions (CVE-2013-3918)

FAQ

Q1. How critical is CVE-2013-3918 and is it actively exploited in the wild?

CVE-2013-3918 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 73.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2013-3918?

Primary impacted vendors include microsoft across windows, internet_explorer. Scope summary: Internet Explorer on Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 Gold/R2

Q3. What temporary mitigations or workarounds exist for CVE-2013-3918 before patching?

[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION