CVE-2013-3918
Published: 12 November 2013
Summary
CVE-2013-3918 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is an out-of-bounds write flaw (CWE-787) in the InformationCardSigninHelper Class ActiveX control within icardie.dll. It affects multiple Microsoft Windows versions including XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Server 2012 Gold/R2, and Windows RT Gold/8.1 when accessed through Internet Explorer.
Remote attackers can exploit the issue by serving a specially crafted web page to victims using Internet Explorer. Successful exploitation grants arbitrary code execution or triggers a denial of service, with the attack requiring only that the user visit the malicious page.
Microsoft security bulletins and US-CERT alerts recommend applying the patches released on Update Tuesday in November 2013 to address the ActiveX control issue. Organizations are also advised to enable kill bits for the vulnerable control and to monitor for signs of the associated watering-hole campaigns.
The vulnerability was observed being exploited in the wild in November 2013 as part of targeted attacks, including FireEye-reported incidents leveraging compromised legitimate sites.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2013-3850
Vulnerability details
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and…
more
R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
- CWE(s)
- KEV Date Added
- 06 October 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor patch that eliminates the out-of-bounds write in icardie.dll.
Least-functionality setting (kill bit) disables the vulnerable InformationCardSigninHelper ActiveX control before IE can load it.
Mobile-code policy can restrict or block execution of untrusted ActiveX controls delivered via web pages.