CVE-2013-3897

microsoft internet explorer

Published 9 Oct 2013 · updated 16 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Mar 2022, with a remediation deadline of 24 Mar 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."

References

blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx · Broken Link, Vendor Advisory
www.us-cert.gov/ncas/alerts/TA13-288A · Third Party Advisory, US Government Resource
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 · Patch, Vendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18989 · Broken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3897 · US Government Resource