{"id":"CVE-2013-2551","kind":"vulnerability","aliases":["CVE-2013-2551"],"related":[],"title":"Microsoft Internet Explorer: Microsoft Internet Explorer Use-After-Free Vulnerability","description":"Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka \"Internet Explorer Use After Free Vulnerability,\" a different vulnerability than CVE-2013-1308 and CVE-2013-1309.","summary":"Microsoft Internet Explorer has a use-after-free bug that lets a crafted web page make it access a deleted object. An attacker who lures a user to that page can run code on the victim's machine.","severity":"critical","cvss":9.3,"epss":0.73918,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Microsoft Internet Explorer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["end-user-machines","exploited","internet-explorer","package","ransomware","windows"],"not_affected_if":["internet-explorer-not-installed","patched-systems"],"how_to_check":null,"fix":"Apply the Microsoft updates for Internet Explorer per vendor instructions, as CISA requires; the specific patch or version is unknown from the sources.","status":"open","published_at":"2013-03-11T10:55:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:42+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:19:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Internet Explorer per vendor instructions, as CISA requires; the specific patch or version is unknown from the sources.","reach":"internet","impact":"high","summary":"Microsoft Internet Explorer has a use-after-free bug that lets a crafted web page make it access a deleted object. An attacker who lures a user to that page can run code on the victim's machine.","category":"package","who_cares":["windows","internet-explorer","end-user-machines"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs code on the victim's machine via a crafted web page","analyst_note":"Confirm the affected and fixed Internet Explorer versions and the Microsoft security bulletin ID from the MS advisory, which the sources do not name.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["internet-explorer-not-installed","patched-systems"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000464,"input_tokens":2850,"output_tokens":357,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1308':126C '-1309':130C '-2013':13A,16A,125C,129C '-2551':14A,17A '10':82C '2013':112C '6':80C 'access':50B,97C 'aka':113C 'allow':83C 'arbitrari':88C 'attack':55B,85C 'bug':41B 'cansecwest':111C 'code':65B,89C 'competit':109C 'craft':45B,92C 'cve':12A,15A,124C,128C 'delet':52B,100C 'demonstr':103C 'differ':121C 'end':22B 'end-user-machin':21B 'execut':87C 'exploit':25B 'explor':3A,6A,28B,34B,79C,115C 'explorer':20A 'free':10A,40B,74C,118C 'internet':2A,5A,19A,27B,33B,78C,114C 'internet-explor':26B 'let':43B 'lure':57B 'machin':24B,70B 'make':48B 'microsoft':1A,4A,18A,32B,77C 'object':53B,101C 'packag':29B 'page':47B,62B 'pwn2own':108C 'ransomwar':30B 'remot':84C 'run':64B 'site':94C 'trigger':96C 'use':8A,38B,72C,116C 'use-after-fre':7A,37B,71C 'user':23B,59B 'via':90C 'victim':68B 'vulner':11A,75C,119C,122C 'vupen':105C 'web':46B,93C 'window':31B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-03-11T10:55:01+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-2551","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-2551","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:40+00:00","note":null},{"source":"epss","external_id":"CVE-2013-2551","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2551","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-2551","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2551","severity":null,"published_at":"2013-03-11T10:55:01+00:00","modified_at":"2026-06-16T23:53:36+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}