Microsoft Update Tuesday October 2013: Another IE 0

CVE-2013-3893 is a resource-management (memory corruption) flaw in Microsoft Internet Explorer that can allow remote code execution (CWE-399). It is triggered remotely, typically when a user views attacker-controlled web content in a vulnerable version of Internet Explorer. A successful attacker gains the ability to execute arbitrary code in the context of the current user, potentially compromising the workstation. Organizations still running Internet Explorer, which CISA notes may be end-of-life (EoL) and/or end-of-service (EoS), are affected; specific affected version ranges were not provided in the source data. The flaw was patched in Microsoft's October 2013 Patch Tuesday after being exploited in the wild (Operation DeputyDog, per related reporting), and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-08-12 with a very high EPSS of 85.9% (100th percentile), indicating active or imminent exploitation.

Do: Apply mitigations per Microsoft's vendor instructions and follow applicable BOD 22-01 guidance for cloud services, or discontinue use of Internet Explorer if mitigations are unavailable, per CISA's required action. Verify that affected systems have the October 2013 Patch Tuesday (or later) cumulative Internet Explorer security updates installed, and audit your estate for remaining legacy IE usage. Where IE is still needed for legacy sites, migrate to Microsoft Edge with IE mode and treat in-the-wild exploitation as likely given the KEV listing and 85.9% EPSS.

CVE-2013-3896 is an information-disclosure flaw in Microsoft Silverlight caused by improper input validation (CWE-20): Silverlight does not correctly validate pointers when accessing Silverlight elements. An attacker triggers it by inducing a user to run a crafted Silverlight application, typically delivered through a malicious or compromised web page. Successful exploitation allows the attacker to obtain sensitive information from the affected system, though the flaw does not provide code execution. All deployments of Microsoft Silverlight are affected, and the product is now end-of-life per CISA. The flaw is listed in the CISA KEV catalog (added 2022-05-25) and carries a high probability of exploitation (EPSS 69.6%, 99th percentile), with ransomware use listed as unknown; no public PoC is known.

Do: Because Microsoft Silverlight is end-of-life, CISA's required action is to disconnect or retire any systems still using it; the cleanest fix is to uninstall the Silverlight runtime where it is no longer needed. If Silverlight must remain on legacy systems, apply Microsoft's October 2013 Patch Tuesday Silverlight security update (released the same cycle as the IE zero-day fixes). Audit endpoints and web apps for Silverlight dependencies, and treat any remaining Silverlight-enabled browsing paths as legacy risk.

CVE-2013-3897 is a use-after-free vulnerability in the CDisplayPointer component of Microsoft Internet Explorer that enables remote code execution when a user views attacker-controlled web content. It is triggered by luring a user to a malicious or compromised webpage where Internet Explorer references memory that has already been freed, allowing the attacker to corrupt memory and execute arbitrary code with the rights of the logged-on user. Any user or organization browsing with Internet Explorer on Windows was exposed; the flaw was fixed in Microsoft's October 2013 Patch Tuesday cumulative IE security updates, and because Internet Explorer is now retired, remaining exposure sits on legacy Windows estates and IE-dependent legacy web applications. Exploitation is confirmed: the bug was exploited as a zero-day in targeted attacks when disclosed in late September 2013, it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03; ransomware use unknown), and EPSS estimates a 77.5% probability of exploitation within 30 days (100th percentile). No public proof-of-concept exploit is documented in the source data, but confirmed in-the-wild use makes patching or browser migration urgent.

Do: Apply Microsoft's October 2013 Patch Tuesday cumulative Internet Explorer security update (MS13-080) per vendor/CISA instructions, prioritizing internet-facing and legacy Windows hosts where IE is still used for browsing or legacy web applications. Because IE is retired and no longer receives security fixes, migrate any remaining IE-dependent users to a supported modern browser and hunt for indicators of the historical in-the-wild exploitation. Ransomware use is unknown per the KEV entry and no public PoC is available, so treat patching and migration, not signature detection, as the primary control.