CVE-2013-3893: Microsoft Internet Explorer use after free in mshtml.dll

CVE-2013-3893 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-08-12

A critical vulnerability in Microsoft Internet Explorer allows attackers to take complete control of a computer if a user visits a malicious website. This flaw affects older versions of the browser that are largely no longer supported, posing a significant risk to organizations still using legacy systems. Successful exploitation could lead to the theft of sensitive data, installation of malware, or a total disruption of business operations.

Technologies: Microsoft Edge, Microsoft Internet Explorer. Vendors: Microsoft.

Quick answers

Is CVE-2013-3893 exploited in the wild?
Yes. CVE-2013-3893 is known to be exploited in the wild, first recorded on 12 August 2025. Treat it as urgent.
How severe is CVE-2013-3893?
Critical severity, with a CVSS score of 8.8, published 12 August 2025.
Which products and versions are affected?
Microsoft Internet Explorer 6 through 11.
Is there a fix for CVE-2013-3893?
A patch was published on 2013-10-08: Microsoft released security bulletin MS13-080 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2013-3893 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2013-3893?
Check whether you run Microsoft Edge or Microsoft Internet Explorer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the SetMouseCapture implementation within mshtml.dll in Microsoft Internet Explorer versions 6 through 11. The flaw is triggered when the browser improperly handles objects in memory during resource management, specifically when processing crafted JavaScript strings. An attacker can exploit this by enticing a user to visit a specially crafted webpage, potentially using an ms-help: URL to trigger the loading of hxds.dll to bypass security mitigations. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the current user. This vulnerability has been observed in active, targeted attacks in the wild.

Affected products

  • Microsoft Internet Explorer 6 through 11

Timeline

  • 2013-09-17: advisory: Microsoft released initial workaround information
  • 2013-10-08: patched: Microsoft released security bulletin MS13-080 to address the issue
  • 2013-10-08: exploited: Confirmed active exploitation in limited, targeted attacks
  • 2025-08-12: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.