5.5

CVE-2013-3896: Microsoft Silverlight Information Disclosure Vulnerability

CVSS: 5.5v3.1MediumKEVAnalyzed
Published 09-10-2013Last modified 22-10-2025
Open JSON

Vulnerability summary

CVE-2013-3896 is a medium (CVSS 5.5) vulnerability in Microsoft Silverlight. It is known to be exploited: CISA lists it, first on 25-05-2022. EPSS estimates a 67.96% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
67.96%
0%100%
Critical · -1.44 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2exploit-database, metasploit

Timeline

  1. 09-10-2013
    PublishedVulnerability first disclosed.
  2. 25-05-2022
    Added to CISA KEVMicrosoft Silverlight Information Disclosure Vulnerability
  3. 15-06-2022
    CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
  4. 22-10-2025
    Last modifiedVulnerability information updated.

Description

Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

67.96%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

-1.44 pp

From 69.40% on 19-09-2026

19-09-202619-10-2026
EPSS score
67.96%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-05-2022
Federal due date
15-06-2022

CISA required action

The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2013-3896

Public exploits

2 found
  • exploit-databaselocalwindowsVerified

    Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteUnverified

    MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access

    exploit/windows/browser/ms13_022_silverlight_script_object

    Maturity: poc

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Microsoft1 product

1 vendor · 1 product

References

5 links