CVE-2013-0074

🗓️ 13 Mar 2013 00:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov👁 1103 Views🌐 WEB

Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability.

Reporter	Title	Published	Views	Family All 37
zdt	Microsoft Internet Explorer COALineDashStyleArray Unsafe Memory Access	26 Nov 201300:00	–	zdt
zdt	MS12-022 Microsoft Internet Explorer COALineDashStyleArray Unsafe Memory Access	27 Nov 201300:00	–	zdt
zdt	Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) Exploit	23 Mar 201700:00	–	zdt
attackerkb	CVE-2013-0074	13 Mar 201300:00	–	attackerkb
Information Security Automation	September 2023: VM courses, Bahasa Indonesia, Russian Podcasts, Goodbye Tinkoff, MS Patch Tuesday, Qualys TOP 20, Linux, Forrester, GigaOm, R-Vision VM	30 Sep 202319:31	–	avleonov
BDU FSTEC	The vulnerability of the Microsoft Silverlight software platform, related to insufficient checking of pointers, allows a perpetrator to execute arbitrary code or gain access to read, modify, or delete data.	9 Jun 202200:00	–	bdu_fstec
Circl	CVE-2013-0074	12 Mar 201300:00	–	circl
CISA KEV Catalog	Microsoft Silverlight Double Dereference Vulnerability	25 May 202200:00	–	cisa_kev
Check Point Advisories	Microsoft Silverlight Pointer Dereference Memory Corruption (MS13-022; CVE-2013-0074; CVE-2013-3896)	2 Apr 201300:00	–	checkpoint_advisories
Cvelist	CVE-2013-0074	13 Mar 201300:00	–	cvelist

NVD

Node

microsoft silverlightRange5.0–5.1.20125.0

Source	Link
docs	www.docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022
oval	www.oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16565
us-cert	www.us-cert.gov/ncas/alerts/TA13-071A
oval	www.oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16516
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description
InitParams	path	/AppManifest.xaml	Microsoft Silverlight vulnerability CVE-2013-0074 enabling remote code execution via crafted Silverlight deployment loaded from a manipulated deployment manifest.
payload	path	/AppManifest.xaml	Microsoft Silverlight vulnerability CVE-2013-0074 enabling remote code execution via crafted Silverlight deployment loaded from a manipulated deployment manifest.
InitParams	path	/<xap_name>.xap	Microsoft Silverlight vulnerability CVE-2013-0074 enabling remote code execution via crafted Silverlight deployment loaded from a manipulated XAP payload.
payload	path	/<xap_name>.xap	Microsoft Silverlight vulnerability CVE-2013-0074 enabling remote code execution via crafted Silverlight deployment loaded from a manipulated XAP payload.
InitParams	path	/<dll_name>.dll	Microsoft Silverlight vulnerability CVE-2013-0074 enabling remote code execution via crafted Silverlight deployment loaded from a manipulated DLL.
payload	path	/<dll_name>.dll	Microsoft Silverlight vulnerability CVE-2013-0074 enabling remote code execution via crafted Silverlight deployment loaded from a manipulated DLL.
InitParams	path	/	Initial exploit HTML page served to deliver the Silverlight payload as part of the browser exploit server.
payload	path	/	Initial exploit HTML page served to deliver the Silverlight payload as part of the browser exploit server.

14 Aug 2026 05:16Current

9.3Critical risk

Vulners AI Score9.3

CVSS 3.17.8

CVSS 29.3

EPSS0.78885

SSVC

In Wild