---
id: "CVE-2013-7331"
kind: "vulnerability"
aliases: ["CVE-2013-7331"]
title: "Microsoft Internet Explorer: Microsoft Internet Explorer Information Disclosure Vulnerability"
severity: "medium"
cvss: 6.5
epss: 0.5021
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Microsoft Internet Explorer", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "internet-explorer", "vendor", "windows"]
not_affected_if: ["no-internet-explorer"]
published_at: "2014-02-26T14:55:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-7331", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-7331", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7331", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Internet Explorer: Microsoft Internet Explorer Information Disclosure Vulnerability

Internet Explorer lets a web page query which resources are loaded into memory, which reveals whether anti-malware products are present. An attacker can use that to tailor malware to avoid detection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Internet Explorer affected ? fixed ?

## Fix

Apply Microsoft's updates for Internet Explorer per vendor instructions, as CISA requires; retire IE where possible.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-7331
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2013-7331
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-7331

## From the sources

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_