CVE-2013-0074

HIGH KEV RANSOMWARE

Microsoft Silverlight <5.1.20125.0 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2013-0074 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 25, 2022, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including Metasploit, James Forshaw, Vitaliy Toropov, juan vazquez, including a Metasploit module exploits/windows/browser/ms13_022_silverlight_script_object.

AI-analyzed exploit summary This Metasploit module exploits CVE-2013-0074, a memory corruption vulnerability in Microsoft Silverlight's COALineDashStyleArray, combined with an info leak (CVE-2013-3896) to bypass DEP/ASLR. It delivers a malicious XAP file to achieve arbitrary code execution on Windows systems via Internet Explorer.

Description

Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/29858

This Metasploit module exploits CVE-2013-0074, a memory corruption vulnerability in Microsoft Silverlight's COALineDashStyleArray, combined with an info leak (CVE-2013-3896) to bypass DEP/ASLR. It delivers a malicious XAP file to achieve arbitrary code execution on Windows systems via Internet Explorer.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Silverlight (versions affected by MS13-022 and MS13-087)
No auth needed
Prerequisites: Victim must visit a malicious webpage using Internet Explorer with Silverlight installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/41702

This Metasploit module exploits CVE-2013-3896, a vulnerability in Microsoft Silverlight's ScriptObject Initialize() method, which allows unsafe memory access leading to arbitrary code execution. It bypasses DEP/ASLR using a secondary vulnerability in the WriteableBitmap class and has been tested on IE6-IE10 and Windows XP/7.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Silverlight (versions affected by MS13-022 and MS13-087)
No auth needed
Prerequisites: Target must have vulnerable Silverlight installed · Target must visit a malicious webpage hosting the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC NORMAL
by James Forshaw, Vitaliy Toropov, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb

This Metasploit module exploits CVE-2013-0074, a memory corruption vulnerability in Microsoft Silverlight's ScriptObject Initialize() method, combined with an info leak (CVE-2013-3896) to bypass DEP/ASLR. It delivers a malicious XAP file and DLL to achieve arbitrary code execution on vulnerable Windows systems.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Microsoft Silverlight (versions affected by MS13-022)
No auth needed
Prerequisites: Victim must visit a malicious webpage with Silverlight installed · Target must be using Internet Explorer (IE6-IE10) on Windows XP SP3 or Windows 7 SP1
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/ncas/alerts/TA13-071A
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022

Scores

CVSS v3 7.8
EPSS 0.9369
EPSS Percentile 99.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-05-25
VulnCheck KEV 2014-06-06
InTheWild.io 2013-11-15
ENISA EUVD EUVD-2013-0117
Ransomware Use Confirmed
Status published
Products (1)
microsoft/silverlight 5.0 - 5.1.20125.0
Published Mar 13, 2013
KEV Added May 25, 2022
Tracked Since Feb 18, 2026