What is the CVSS score of CVE-2013-3906?

CVE-2013-3906 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 92.6%.

Which versions of Microsoft are affected by CVE-2013-3906?

CVE-2013-3906 presents notable security risk, a code injection vulnerability rated CVSS 7.8.. A patch is available.

Is there a public PoC exploit available for CVE-2013-3906?

Yes, a public proof-of-concept exploit is available for CVE-2013-3906. Prioritise patching immediately. EPSS: 92.6%.

How to fix or mitigate CVE-2013-3906?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Microsoft CVE-2013-3906

HIGH

Code Injection (CWE-94)

2013-11-06 secure@microsoft.com

Code Injection Microsoft RCE

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Oct 22, 2025 - 01:15 cisa

CISA KEV

PoC Detected

Oct 22, 2025 - 01:15 vuln.today

Public exploit code

Patch released

Oct 22, 2025 - 01:15 nvd

Patch available

CVE Published

Nov 06, 2013 - 15:55 nvd

HIGH 7.8

DescriptionCVE.org

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

AnalysisAI

GDI+ in Microsoft Windows and Office fails to properly handle TIFF images, allowing remote code execution through crafted documents, actively exploited in targeted attacks against Pakistani and Middle Eastern organizations.

Technical ContextAI

The CWE-94 vulnerability in GDI+'s TIFF codec allows specially crafted TIFF images to trigger code execution when rendered by any application using GDI+ (including Office, Lync, and Windows Photo Viewer). Attackers embedded exploit TIFF images in Word documents for delivery.

RemediationAI

Apply Microsoft security update MS13-096. Disable TIFF rendering via the TIFF codec workaround. Block documents with embedded TIFF images at the email gateway.

CVE-2013-3906 vulnerability details – vuln.today

Back

Microsoft CVE-2013-3906

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code