CVE-2013-3897: Internet Explorer mshtml CDisplayPointer use-after-free RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a very high EPSS score, but it requires user interaction and affects only legacy Internet Explorer.

What it is

Microsoft Internet Explorer 6 through 11 contains a use-after-free in the CDisplayPointer class in mshtml.dll. Crafted JavaScript using the onpropertychange event handler corrupts memory, allowing remote code execution or denial of service. It was exploited in the wild in September and October 2013, making it a real, not theoretical, risk for unpatched IE users.

Impact

An attacker can execute arbitrary code in the context of the logged-on user, or crash the browser. Successful exploitation typically gives the attacker the same rights as the victim, enabling host compromise.

Attack surface

Reached over the network by luring a user to a malicious or compromised web page that runs crafted JavaScript; the CVSS vector shows no privileges required but user interaction required. No authentication is needed on the target.

Exploitation

Listed in CISA KEV since 2022-03-03 with a required action to apply vendor updates, and EPSS 30-day probability is 0.77462 (99.5th percentile). References include vendor advisories and a patch bulletin, and the description states it was exploited in the wild in 2013.

What to do

• Apply the Microsoft MS13-080 security update for Internet Explorer immediately.
• Retire or block Internet Explorer; migrate users to a supported browser.
• Enforce EMET or equivalent exploit mitigations on systems that must still run IE.
• Restrict browsing to trusted sites and block known malicious domains at the network edge.
• Disable or restrict the onpropertychange event handler where feasible in legacy IE deployments.

Detection

• Hunt for IE processes (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Monitor for crashes in mshtml.dll and unusual IE memory-corruption events.
• Review proxy and DNS logs for known exploit-kit or malicious domains tied to 2013 IE campaigns.
• Alert on KEV-listed CVE-2013-3897 exploitation attempts in IDS/IPS signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.