peter bassill · operator
$ cve CVE-2013-0090 JSON

CVE-2013-0090 EXPLOIT

8.8
HIGH · CVSS 3.1 · EPSS 38.2% (pctl 99)

Patch early

A public exploit exists.

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CCaret Use After Free Vulnerability."

Scoring

CVSS8.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS38.22% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-399
On CISA KEVno
Public exploityes
Published2013-03-13
Last modified2026-06-16

Affected (9)

VendorProduct
microsoftinternet explorer
microsoftwindows 7
microsoftwindows 8
microsoftwindows rt
microsoftwindows server 2003
microsoftwindows server 2008
microsoftwindows server 2012
microsoftwindows vista
microsoftwindows xp

Public exploits

SourceTitleDate
exploit-dbMicrosoft Internet Explorer 9 - IEFRAME CView::Ensure­Size Use-After-Free (MS13-021)2016-12-16

References

→ the Explorer  ·  watch your stack  ·  NVD