{"schemaVersion":3,"id":"CVE-2013-3893","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft Internet Explorer Resource Management Errors Vulnerability","description":"Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.","dates":{"published":"2013-09-18T10:00:00.000Z","modified":"2025-10-22T00:05:40.792Z","reserved":null,"kevAdded":["2025-08-12T00:00:00.000Z"],"kevDue":["2025-09-02T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.87526,"percentile":0.99758,"severity":"critical","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":1.713000000000009,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.85813},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.8593,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.8593,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.8593,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.8593,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87526,"percentile":0.99758}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.85813,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87526,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87526,"percentile":0.99758}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-08-12T00:00:00.000Z","dueDate":"2025-09-02T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Microsoft Internet Explorer Resource Management Errors Vulnerability","description":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","notes":[{"type":"url","href":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080","label":"learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2013-3893","label":"nvd.nist.gov/vuln/detail/CVE-2013-3893"}],"vendor":"Microsoft","product":"Internet Explorer","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-08-12T00:00:00.000Z","dueDate":"2025-09-02T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Microsoft Internet Explorer Resource Management Errors Vulnerability","description":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","notes":[{"type":"url","href":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080","label":"learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2013-3893","label":"nvd.nist.gov/vuln/detail/CVE-2013-3893"}],"vendor":"Microsoft","product":"Internet Explorer","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_975C4FD73022470D","name":"Exploit Reference (pastebin.com)","source":"reference","url":"http://pastebin.com/raw.php?i=Hx1L5gu6","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_6F864B25984D91A3","name":"Exploit Reference (blogs.technet.com)","source":"reference","url":"http://blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_274E99A9F42C283D","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/162585/Microsoft-Internet-Explorer-8-SetMouseCapture-Use-After-Free.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"49872","name":"Microsoft Internet Explorer 8 - 'SetMouseCapture ' Use After Free","source":"exploit-database","url":"https://www.exploit-db.com/exploits/49872","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"local","platform":"windows","file":"exploits/windows/local/49872.js","codes":["CVE-2013-3893"]},"metasploit":null},{"id":"28682","name":"Micorosft Internet Explorer - SetMouseCapture Use-After-Free (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/28682","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/28682.rb","codes":["CVE-2013-3893","OSVDB-97380"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_BROWSER_IE_SETMOUSECAPTURE_UAF","name":"MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/browser/ie_setmousecapture_uaf.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/browser/ie_setmousecapture_uaf","rank":"300","rankName":"normal","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":6,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"microsoft","product":"internet_explorer","name":"Internet Explorer","label":"internet_explorer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6","noFixRecorded":false,"fixedIn":null},{"text":"7","noFixRecorded":false,"fixedIn":null},{"text":"8","noFixRecorded":false,"fixedIn":null},{"text":"9","noFixRecorded":false,"fixedIn":null},{"text":"10","noFixRecorded":false,"fixedIn":null},{"text":"11:developer-preview","noFixRecorded":false,"fixedIn":null},{"text":"11:release-preview","noFixRecorded":false,"fixedIn":null}],"versionsText":"6 | 7 | 8 | 9 | 10 | 11:developer-preview | 11:release-preview","eol":{"isEol":true,"eolDate":"2023-10-10T00:00:00.000Z","matchMethod":"name_exact","cycle":{"name":"7","label":"7","eolFrom":"2023-10-10T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"internet-explorer","label":"Internet Explorer","category":"app"}},"hubHref":"/vendor/microsoft/internet_explorer"}],"affectedCount":1,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000093.html","label":"jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000093.html","hostname":"jvndb.jvn.jp","tags":["Third Party Advisory","X Refsource JVNDB"]},{"url":"http://jvn.jp/en/jp/JVN27443259/index.html","label":"jvn.jp/en/jp/JVN27443259/index.html","hostname":"jvn.jp","tags":["Third Party Advisory","X Refsource JVN"]},{"url":"http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx","label":"blogs.technet.com/b/…","hostname":"blogs.technet.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/62453","label":"www.securityfocus.com/bid/62453","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18665","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18665","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA13-288A","label":"www.us-cert.gov/ncas/alerts/TA13-288A","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://technet.microsoft.com/security/advisory/2887505","label":"technet.microsoft.com/security/advisory/2887505","hostname":"technet.microsoft.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS"]},{"url":"http://pastebin.com/raw.php?i=Hx1L5gu6","label":"pastebin.com/raw.php?i=Hx1L5gu6","hostname":"pastebin.com","tags":["X Refsource MISC","Exploit"]},{"url":"http://blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx","label":"blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx","hostname":"blogs.technet.com","tags":["X Refsource CONFIRM","Exploit"]},{"url":"http://packetstormsecurity.com/files/162585/Microsoft-Internet-Explorer-8-SetMouseCapture-Use-After-Free.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3893","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3893","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2013-09-18T10:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2025-08-12T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft Internet Explorer Resource Management Errors Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2025-09-02T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:40.792Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T05:24:50.959Z","stale":false,"partial":false}}