Microsoft CVE-2013-3893
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
AnalysisAI
Internet Explorer 6 through 11 contain a use-after-free vulnerability in the SetMouseCapture implementation that allows remote code execution through crafted JavaScript, exploited in targeted attacks via ms-help: URL protocol.
Technical ContextAI
The CWE-399 use-after-free occurs in the mouse capture subsystem of mshtml.dll. Attackers used crafted JavaScript strings to trigger the free and reuse cycle. The innovative exploitation technique used ms-help: protocol URLs to load hxds.dll, a non-ASLR module, providing predictable gadget addresses for ROP chains.
RemediationAI
Apply Microsoft security update MS13-080. Disable the ms-help: URL protocol handler. Deploy EMET or Windows Defender Exploit Guard with forced ASLR.
More from same product – last 7 days
{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Share
External POC / Exploit Code
Leaving vuln.today