Vulnerability record · CVE-2013-0810 · published 11 September 2013
CVE-2013-0810: Windows Theme File Screensaver Remote Code Execution
Microsoft · Windows Server 2003
A crafted screensaver referenced in a Windows theme file allows remote code execution on Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2. The flaw is a code injection issue in how theme files are processed, and it matters because it enables arbitrary code execution on unpatched legacy systems.
Description
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability."
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.1 with network reachability and high EPSS, but exploitation is not confirmed in KEV and the affected platforms are legacy.
What it is
A crafted screensaver referenced in a Windows theme file allows remote code execution on Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2. The flaw is a code injection issue in how theme files are processed, and it matters because it enables arbitrary code execution on unpatched legacy systems.
Impact
An attacker who gets a victim to load a malicious theme file can execute arbitrary code with the privileges of the logged-on user, giving full control of confidentiality, integrity, and availability on the host.
Attack surface
Reached remotely over the network via a crafted theme file containing a malicious screensaver, per the CVSS vector AV:N/PR:N/UI:N. The record does not describe the exact delivery mechanism, so whether any user interaction is truly required is not established by the supplied facts.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.59885, 99.089th percentile), indicating elevated predicted exploitation likelihood, but the references are only vendor and government advisories with no exploit tags.
What to do
- Apply Microsoft security bulletin MS13-071 to affected Windows XP, Server 2003, Vista, and Server 2008 SP2 systems.
- Upgrade or migrate off the affected end-of-life platforms, which no longer receive security updates.
- Block or restrict delivery of untrusted .theme and screensaver files via email, web, and file shares.
- Enforce least privilege so users do not operate with administrative rights.
- Disable or restrict screensaver and theme file handling where business needs allow.
Detection
- Monitor for unexpected screensaver (.scr) or .theme file creation and execution in user profile and temp directories.
- Alert on process creation where a screensaver or theme handler spawns unusual child processes such as cmd.exe or powershell.exe.
- Review file share, email gateway, and web proxy logs for .theme or .scr attachments and downloads from untrusted sources.
- Audit hosts still running Windows XP, Server 2003, Vista, or Server 2008 SP2 for missing MS13-071 patches.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-0810 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-0810), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
