{"id":"CVE-2013-3897","kind":"vulnerability","aliases":["CVE-2013-3897"],"related":[],"title":"Microsoft Internet Explorer: Microsoft Internet Explorer Use-After-Free Vulnerability","description":"Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka \"Internet Explorer Memory Corruption Vulnerability.\"","summary":"A use-after-free bug in Internet Explorer's CDisplayPointer component lets a remote attacker run arbitrary code. It is listed as actively exploited in the wild.","severity":"critical","cvss":9.3,"epss":0.7731,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Microsoft Internet Explorer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","internet-explorer","other","windows"],"not_affected_if":["ie-removed","no-ie-installed"],"how_to_check":"Check whether Internet Explorer is installed and which version: run 'reg query \"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\" /v svcVersion' on Windows. Note: the sources do not give a check command, so this is a general check.","fix":"Apply Microsoft's security update for Internet Explorer per vendor instructions, as CISA requires. Sources do not name the specific KB or fixed version.","status":"open","published_at":"2013-10-09T14:54:25+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:03+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T21:26:03Z","model":"claude-haiku-5-5","output":{"fix":"Apply Microsoft's security update for Internet Explorer per vendor instructions, as CISA requires. Sources do not name the specific KB or fixed version.","reach":"internet","impact":"high","summary":"A use-after-free bug in Internet Explorer's CDisplayPointer component lets a remote attacker run arbitrary code. It is listed as actively exploited in the wild.","category":"other","who_cares":["windows","internet-explorer"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the victim's Windows machine remotely.","analyst_note":"Find the Microsoft advisory and the exact patched Internet Explorer builds for CVE-2013-3897 (search the CISA KEV entry link in sources) so the fix and version check can be made specific.","how_to_check":"Check whether Internet Explorer is installed and which version: run 'reg query \"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\" /v svcVersion' on Windows. Note: the sources do not give a check command, so this is a general check.","needs_analyst":true,"not_affected_if":["no-ie-installed","ie-removed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000509,"input_tokens":2844,"output_tokens":449,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2013':13A,16A '-3897':14A,17A '11':72C '2013':107C '6':70C 'activ':50B 'aka':108C 'allow':73C 'arbitrari':44B,78C 'attack':42B,75C 'bug':32B 'caus':81C 'cdisplaypoint':37B,62C 'class':63C 'code':45B,79C,91C 'compon':38B 'corrupt':87C,112C 'craft':89C 'cve':12A,15A 'denial':83C 'event':96C 'execut':77C 'exploit':21B,51B,99C 'explor':3A,6A,24B,35B,69C,110C 'explorer':20A 'free':10A,31B,58C 'handler':97C 'internet':2A,5A,19A,23B,34B,68C,109C 'internet-explor':22B 'javascript':90C 'let':39B 'list':48B 'memori':86C,111C 'microsoft':1A,4A,18A,67C 'mshtml.dll':65C 'octob':106C 'onpropertychang':95C 'remot':41B,74C 'run':43B 'septemb':104C 'servic':85C 'use':8A,29B,56C,93C 'use-after-fre':7A,28B,55C 'via':88C 'vulner':11A,59C,113C 'wild':54B,102C 'window':26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-10-09T14:54:25+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-3897","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-3897","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2013-3897","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-3897","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-3897","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3897","severity":null,"published_at":"2013-10-09T14:54:25+00:00","modified_at":"2026-06-16T23:55:58+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}