Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers…

published 2013-10-09 13 y ago modified 2026-06-16 4 mo ago also EUVD-2013-3829

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-03
epss: 77.3%; EPSS 77.3% chance of exploitation in 30 days, percentile 99.5%
public exploits: 2; Metasploit, Exploit-DB

Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."

Patch / fix

cisa required action Apply updates per vendor instructions.

links 1

docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 advisory

Timeline

2013-10-08 First public exploit (Metasploit exploit/windows/browser/ms13_080_cdisplaypointer)
2013-10-09 Published
2022-03-03 Added to CISA KEV
2022-03-24 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-03-03)
Patch by: 2022-03-24 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Microsoft, Internet Explorer
CISA name: Microsoft Internet Explorer Use-After-Free Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

77.31% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/browser/ms13_080_cdisplaypointer MS13-080 Microsoft Internet Explorer CDisplayPointer Use-After-Free metasploit exploit, normal rank, 2013-10-08
EDB-28974 Microsoft Internet Explorer - CDisplayPointer Use-After-Free (MS13-080) (Metasploit) remote, 2013-10-15

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-416 Use After Free

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2013/ms13-080
vendor-advisory, patch
blogs.technet.com /b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx
broken-link, vendor-advisory
us-cert.gov /ncas/alerts/TA13-288A
third-party-advisory, us-government-resource
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18989
vdb-entry, signature, broken-link
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3897
government-resource, us-government-resource

Sources

CVE List CVE-2013-3897
NVD CVE-2013-3897

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary