CVE entry · CVE-2013-3918
CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability
Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Actively exploited: added to CISA’s KEV catalog on October 6, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: October 27, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Microsoft Windows, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (docs.microsoft.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Microsoft vulnerabilities
-
Microsoft Windows Command Injection Vulnerability
-
Microsoft SharePoint Code Injection Vulnerability
-
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
-
Microsoft Windows Link Following Vulnerability
-
Microsoft SQL Server Remote Code Execution Vulnerability
-
Microsoft SharePoint Weak Authentication Vulnerability