CVEvulnerability

CVE-2013-3897

8.8 HIGH Known exploited Published 2013-10-09 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Internet Explorer Use-After-Free Vulnerability — Microsoft Internet Explorer

A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.

Added to KEV: 2022-03-03
Remediation due: 2022-03-24
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2013-3897

Status: Analyzed
Published: 2013-10-09
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses: CWE-416

Description

Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."

Affected configurations

• microsoft internet explorer 6 • microsoft internet explorer 7 • microsoft internet explorer 8 • microsoft internet explorer 9 • microsoft internet explorer 10 • microsoft internet explorer 11

Weakness · CWE (1)

CWE-416 Use After Free weakness

References