CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability
Vulnerability summary
CVE-2013-3918 is a high (CVSS 9.3) Out-of-bounds Write vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 06-10-2025. EPSS estimates a 73.69% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 12-11-2013PublishedVulnerability first disclosed.
- 06-10-2025Added to CISA KEVMicrosoft Windows Out-of-Bounds Write Vulnerability
- 22-10-2025Last modifiedVulnerability information updated.
- 27-10-2025CISA remediation dueApply mitigations per vendor instructions.
Description
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
73.69%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 73.69% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 06-10-2025
- Federal due date
- 27-10-2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090 nvd.nist.gov/vuln/detail/CVE-2013-3918
Public exploits
2 foundMicrosoft Internet Explorer - CardSpaceClaimCollection ActiveX Integer Underflow (MS13-090) (Metasploit)
Maturity: weaponized
MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow
exploit/windows/browser/ms13_090_cardspacesigninhelper
Maturity: poc
Weaknesses
CWE · root causeAffected systems
1 vendor · 10 products
References
9 links- www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814/X Refsource MISCBroken Link
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090Vendor AdvisoryX Refsource MSPatch- www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.htmlX Refsource MISCThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19089VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
- www.microsoft.com/en-us/…Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3918Government ResourceUS Government Resource