CVE-2013-3163: Microsoft Internet Explorer memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a very high EPSS score and allows unauthenticated remote code execution, though it requires user interaction and affects only end-of-life IE versions.

What it is

Internet Explorer 8 through 10 contains an out-of-bounds write (CWE-787) that corrupts memory when a crafted web page is rendered. A remote attacker can trigger it to execute arbitrary code in the context of the browser or crash it. The flaw is distinct from CVE-2013-3144 and CVE-2013-3151.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the IE process, or a denial of service through memory corruption. Code execution in the browser context can lead to full host compromise depending on the user's rights.

Attack surface

Reached over the network via a crafted web site; the CVSS vector shows no privileges required but user interaction required, meaning the victim must visit or be lured to the malicious page. No authentication is needed.

Exploitation

CVE-2013-3163 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30), and EPSS gives a 30-day probability of 0.70676 (99.36th percentile), indicating active exploitation is expected. No ransomware campaign use is documented.

What to do

• Apply Microsoft security bulletin MS13-055 or the corresponding cumulative update for Internet Explorer.
• Retire or disconnect Internet Explorer 8 through 10, which are end-of-life, as CISA's required action states.
• Migrate users to a supported browser and remove IE as a default handler where possible.
• Block or restrict access to untrusted web content and enforce network-level filtering for legacy IE traffic.

Detection

• Monitor for IE process crashes or unexpected child processes spawned from iexplore.exe.
• Hunt for known exploit artifacts and suspicious script or shellcode delivery in web proxy and DNS logs.
• Alert on outbound connections from hosts still running IE 8 through 10 to untrusted or newly registered domains.
• Review endpoint telemetry for memory corruption indicators and anomalous code execution in the browser process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.