CVE-2013-3896
Published 2013-10-09 · Updated 2026-06-16 · Source secure@microsoft.com
Summary
CVE-2013-3896 is a medium-severity (CVSS 5.5) vulnerability in Microsoft Silverlight. CISA added it to the Known Exploited Vulnerabilities catalog on May 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 15, 2022. CISA does not currently list it as used in ransomware campaigns. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.
All 390 known-exploited Microsoft vulnerabilities →Description
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Microsoft — Silverlight
Name: Microsoft Silverlight Information Disclosure Vulnerability
Date added: 2022-05-25 · Due: 2022-06-15
Required action: The impacted product is end-of-life and should be disconnected if still in use.
References
- http://www.us-cert.gov/ncas/alerts/TA13-288A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19055
- http://www.us-cert.gov/ncas/alerts/TA13-288A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19055