CVE-2013-3918
Memory Safety in Microsoft Windows Server 2008 r2 … sp2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2013-3918 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 0.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an out-of-bounds write flaw (CWE-787) in the InformationCardSigninHelper Class ActiveX control within icardie.dll. It affects multiple Microsoft Windows versions including XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Server 2012 Gold/R2, and Windows RT Gold/8.1 when accessed through Internet Explorer.
Remote attackers can exploit the issue by serving a specially crafted web page to victims using Internet Explorer. Successful exploitation grants arbitrary code execution or triggers a denial of service, with the attack requiring only that the user visit the malicious page.
Microsoft security bulletins and US-CERT alerts recommend applying the patches released on Update Tuesday in November 2013 to address the ActiveX control issue. Organizations are also advised to enable kill bits for the vulnerable control and to monitor for signs of the associated watering-hole campaigns.
The vulnerability was observed being exploited in the wild in November 2013 as part of targeted attacks, including FireEye-reported incidents leveraging compromised legitimate sites.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2013-3850
Vulnerability Data
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and…
more
R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
- CWE(s)
- KEV Date Added
- 06 October 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.