CVE-2013-7331: Microsoft XMLDOM ActiveX control in Internet Explorer leaks local and intranet path information

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a very high EPSS score, though the direct impact is limited to information disclosure.

What it is

The Microsoft.XMLDOM ActiveX control in Internet Explorer on Windows 8.1 and earlier discloses whether local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses exist by exposing differences in error codes. This is an information disclosure flaw that can reveal internal network and host details to a remote attacker, and it was exploited in the wild in February 2014.

Impact

An attacker gains reconnaissance information: confirmation of local files, UNC shares, intranet hostnames, and intranet IP addresses. This does not directly grant code execution but supports targeting and lateral movement planning.

Attack surface

Reached remotely over the network through Internet Explorer rendering attacker-controlled content, such as a res:// URL; the CVSS vector shows no privileges or user interaction required, though in practice the victim must load the malicious page in IE.

Exploitation

CISA added it to the KEV catalog on 2022-05-25, and EPSS shows a 30-day probability of 0.58023 (99th percentile), with an exploit-tagged reference; the description states it was exploited in the wild in February 2014.

What to do

• Apply the Microsoft MS14-052 security update per vendor instructions.
• Retire or disable Internet Explorer and the Microsoft.XMLDOM ActiveX control where possible.
• Restrict or block ActiveX control execution in IE via policy and zone settings.
• Limit browsing to trusted sites and block untrusted res:// and similar URL schemes.
• Monitor for and remove any remaining IE dependencies on affected Windows 8.1 and earlier systems.

Detection

• Search web proxy and IE logs for res:// URL requests and unusual XMLDOM ActiveX instantiation.
• Monitor for repeated error-code probing patterns from a single client to internal hostnames or UNC paths.
• Alert on IE processes loading the Microsoft.XMLDOM control from untrusted or internet zones.
• Correlate endpoint telemetry for IE spawning with network connections to intranet ranges after browsing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.