# CVE-2013-7331: Microsoft Internet Explorer Information Disclosure Vulnerability

Source: https://junglewise.ai/threats/cve-2013-7331-microsoft-internet-explorer-information-disclosure-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-25. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2013-7331 · Severity: critical · CVSS 6.5 · Exploited in the wild · Published 2022-05-25

The Microsoft.XMLDOM ActiveX control in Internet Explorer allows remote attackers to determine the existence of local pathnames, UNC shares, and intranet network information via error code analysis. This information disclosure vulnerability can be used to detect anti-malware applications or map internal networks.

Technologies: [Microsoft Edge](https://junglewise.ai/threats/technologies/edge), [Microsoft Internet Explorer](https://junglewise.ai/threats/technologies/internet-explorer). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2013-7331 exploited in the wild?** Yes. CVE-2013-7331 is known to be exploited in the wild, first recorded on 25 May 2022. Treat it as urgent.

**How severe is CVE-2013-7331?** Critical severity, with a CVSS score of 6.5, published 25 May 2022.

**Which products and versions are affected?** Microsoft Internet Explorer 6, 7, 8, 9, 10, 11; Microsoft Microsoft.XMLDOM ActiveX control Windows 8.1 and earlier.

**Is there a fix for CVE-2013-7331?** A patch was published on 2014-09-09: Microsoft released MS14-052 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-7331 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2013-7331?** Check whether you run Microsoft Edge or Microsoft Internet Explorer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Microsoft Internet Explorer 6, 7, 8, 9, 10, 11
- Microsoft Microsoft.XMLDOM ActiveX control Windows 8.1 and earlier

## Timeline

- 2013-04-01: disclosed: Initial public disclosure of the XMLDOM information leak technique.
- 2014-02-01: exploited: Exploited in the wild in February 2014 (Operation Snowman).
- 2014-09-09: patched: Microsoft released MS14-052 to address the issue.
- 2022-05-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.

## Related threats

- [Microsoft Edge out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-122518-out-of-bounds-read-in-microsoft-edge-chromium-based-allows-an)
- [Microsoft Edge privilege escalation via incorrect authorization](https://junglewise.ai/threats/cve-2026-69446-incorrect-authorization-in-microsoft-edge-chromium-based-allows)
- [Microsoft Edge use-after-free privilege elevation](https://junglewise.ai/threats/cve-2026-96203-use-after-free-in-microsoft-edge-chromium-based-allows-an)
- [Microsoft Edge heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-96199-heap-based-buffer-overflow-in-microsoft-edge-chromium-based)
- [Microsoft Edge heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-96198-heap-based-buffer-overflow-in-microsoft-edge-chromium-based)