9.3

CVE-2013-0074: Microsoft Silverlight Double Dereference Vulnerability

CVSS: 9.3v2.0HighKEVRansomwareAnalyzed
Published 13-03-2013Last modified 14-08-2026
Open JSON

Vulnerability summary

CVE-2013-0074 is a high (CVSS 9.3) vulnerability in Microsoft Silverlight. It is known to be exploited: CISA lists it, first on 25-05-2022. It has been used in ransomware campaigns. EPSS estimates a 78.89% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.3/10
010
High · v2.0 (NVD)
EPSS score
78.89%
0%100%
Critical · -2.12 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits3exploit-database, metasploit

Timeline

  1. 13-03-2013
    PublishedVulnerability first disclosed.
  2. 25-05-2022
    Added to CISA KEVMicrosoft Silverlight Double Dereference Vulnerability
  3. 15-06-2022
    CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
  4. 14-08-2026
    Last modifiedVulnerability information updated.

Description

Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

78.89%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-2.12 pp

From 81.01% on 19-09-2026

19-09-202619-10-2026
EPSS score
78.89%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-05-2022
Federal due date
15-06-2022
Ransomware

CISA required action

The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2013-0074

Public exploits

3 found
  • exploit-databaselocalwindowsVerified

    Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)

    Maturity: weaponized

  • exploit-databaseremotewindowsVerified

    Microsoft Internet Explorer - COALineDashStyleArray Unsafe Memory Access (MS12-022) (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteUnverified

    MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access

    exploit/windows/browser/ms13_022_silverlight_script_object

    Maturity: poc

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Microsoft1 product

1 vendor · 1 product

References

5 links