Vulnerability record · CVE-2013-3918 · published 12 November 2013
CVE-2013-3918: Microsoft Windows InformationCardSigninHelper ActiveX out-of-bounds write
Microsoft · Windows 7
The InformationCardSigninHelper ActiveX control in icardie.dll contains an out-of-bounds write that can be triggered by a crafted web page rendered in Internet Explorer. Successful exploitation allows remote code execution or a denial of service on a wide range of Windows versions, and the flaw was exploited in the wild in November 2013.
Description
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is a remotely reachable, unauthenticated code execution flaw with confirmed in-the-wild exploitation and a CISA KEV listing, despite requiring user interaction.
What it is
The InformationCardSigninHelper ActiveX control in icardie.dll contains an out-of-bounds write that can be triggered by a crafted web page rendered in Internet Explorer. Successful exploitation allows remote code execution or a denial of service on a wide range of Windows versions, and the flaw was exploited in the wild in November 2013.
Impact
An attacker can execute arbitrary code in the context of the logged-on user or crash the affected process. This can lead to full system compromise depending on the user's privileges.
Attack surface
Reached over the network through a crafted web page viewed in Internet Explorer, requiring user interaction to visit or open the page. No authentication is needed, but the victim must load the malicious content.
Exploitation
CVE-2013-3918 is listed in CISA KEV with a due date of 2025-10-27, and EPSS shows a 30-day probability of 0.73872 (99.45th percentile). References describe it as exploited in the wild in November 2013, including a watering hole attack.
What to do
- Apply Microsoft security update MS13-090 (or later cumulative updates) to all affected Windows versions.
- Disable or kill-bit the InformationCardSigninHelper ActiveX control in icardie.dll where the patch cannot be applied.
- Restrict Internet Explorer use and enforce Enhanced Protected Mode or equivalent hardening on remaining IE deployments.
- Follow CISA BOD 22-01 guidance for cloud services and discontinue use of unsupported Windows versions if mitigations are unavailable.
Detection
- Monitor for Internet Explorer processes loading icardie.dll and for unexpected child processes spawned from iexplore.exe.
- Hunt for network requests to known watering hole or exploit delivery domains referenced in the 2013 reporting.
- Check endpoint logs for crashes or memory corruption events in icardie.dll or Internet Explorer.
- Audit systems for the presence of the vulnerable ActiveX control and confirm patch status against MS13-090.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2013-3918 to the Known Exploited Vulnerabilities catalog on 6 October 2025 as "Microsoft Windows Out-of-Bounds Write Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 27 October 2025.
Affected products
10 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-3918 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-3918), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
