CVE-2013-3138: Windows TCP/IP driver integer overflow causes system hang

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated denial of service with high EPSS and broad affected Windows install base, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

The TCP/IP kernel-mode driver in multiple Windows versions contains an integer overflow that can be triggered by crafted TCP packets. A remote attacker can exploit this to hang the affected system, causing a denial of service. The flaw affects Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8, Server 2012, and Windows RT.

Impact

An attacker can cause a full system hang (denial of service) on the target Windows host. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

Reachable over the network via crafted TCP packets sent to the affected host; no authentication is required. No user interaction is indicated by the description or vector.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high (0.5937, 99th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply Microsoft security bulletin MS13-049 immediately on all affected Windows versions.
• Restrict or filter inbound TCP traffic from untrusted networks where feasible.
• Monitor vendor advisories and US-CERT alert TA13-168A for updated guidance.
• Prioritize patching internet-facing and unpatched legacy Windows systems first.

Detection

• Monitor for unexpected system hangs or reboots on affected Windows hosts.
• Inspect network traffic for malformed or unusual TCP packets targeting affected systems.
• Correlate host availability alerts with inbound TCP traffic anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.