# CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability

Source: https://junglewise.ai/threats/cve-2013-3906-microsoft-graphics-component-memory-corruption-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-15. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2013-3906 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2022-02-15

A memory corruption vulnerability in the Microsoft Graphics Component (GDI+) allows for remote code execution via specially crafted TIFF images. Attackers can exploit this by embedding malicious images in documents, such as Microsoft Word files, which execute code when processed by the vulnerable component.

Technologies: [Microsoft Graphics Component](https://junglewise.ai/threats/technologies/graphics-component). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2013-3906 exploited in the wild?** Yes. CVE-2013-3906 is known to be exploited in the wild, first recorded on 15 February 2022. Treat it as urgent.

**How severe is CVE-2013-3906?** Critical severity, with a CVSS score of 7.8, published 15 February 2022.

**Which products and versions are affected?** Microsoft Windows Vista SP2; Microsoft Windows Server 2008 SP2; Microsoft Office 2003 SP3; Microsoft Office 2007 SP3; and 4 more.

**Is there a fix for CVE-2013-3906?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2013-3906 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2013-3906?** Check whether you run Microsoft Graphics Component. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Microsoft Windows Vista SP2
- Microsoft Windows Server 2008 SP2
- Microsoft Office 2003 SP3
- Microsoft Office 2007 SP3
- Microsoft Office 2010 SP1, SP2
- Microsoft Office Compatibility Pack SP3
- Microsoft Lync 2010 Attendee
- Microsoft Lync 2013 Basic 2013

## Timeline

- 2013-10: exploited: Exploited in the wild in October and November 2013.
- 2022-02-15: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- 2022-02-15: disclosed

## Related threats

- [Microsoft Graphics Component out-of-bounds read](https://junglewise.ai/threats/cve-2026-112754-out-of-bounds-read-in-microsoft-graphics-component-allows-an)
- [Microsoft Graphics Component stack buffer overflow](https://junglewise.ai/threats/cve-2026-85881-stack-based-buffer-overflow-in-microsoft-graphics-component)
- [Microsoft Graphics Component out-of-bounds read privilege elevation](https://junglewise.ai/threats/cve-2026-85338-out-of-bounds-read-in-microsoft-graphics-component-allows-an)
- [Microsoft Graphics Component numeric truncation privilege escalation](https://junglewise.ai/threats/cve-2026-70123-numeric-truncation-error-in-microsoft-graphics-component-allows)
- [Microsoft Graphics Component information disclosure](https://junglewise.ai/threats/cve-2026-105731-use-of-uninitialized-resource-in-microsoft-graphics-component)