Live › vulnerability › CVE-2013-3906
Go to dashboardMicrosoft Graphics Component (Office/Windows graphics code) has a memory corruption bug that a crafted document can trigger. An attacker who gets a user to open the malicious file can run code on that machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Graphics Component | vendor | – | – |
Unknown from the sources.
Apply the Microsoft update for CVE-2013-3906 per vendor instructions (CISA required action); the sources do not name the patch KB or affected versions.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
This page as .md · .json · in your agent: get_signal("CVE-2013-3906")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.