CVE-2013-3893

ENISA EUVD: EUVD-2013-3825 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 20, 2026 6 articles Published: 2013-09-18
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23
82.61%
probability
This CVE has a 82.61% probability of being exploited in the next 30 days.
0% Top 99.3th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
8.8
HIGH
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2 (legacy)

9.3
HIGH
Access Vector
Network
Access Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

VulnerabilityLookup (CNA)
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.

Affected Products

n/a
n/a

Attack Intelligence

Exploits & PoC

Signal Intelligence

Confidenceⓘ
85%
EPSS 82.61%
CVSS v3.1 8.8
Mentions 6

CNA Information

CNA Assigner
microsoft

Analyst Note

CVE-2013-3893 is explicitly named as an Internet Explorer zero-day exploited in the wild via watering hole attacks targeting Japanese users, with exploitation documented by FireEye. The 2013 CVE year and active exploitation reports align with the zero-day timeline, and the vulnerability was being exploited before patches were publicly available.

Threat Actors 2

RomCom
apt_group Financial gain 🇷🇺 RU
Void Rabisu
apt_group Financial gain 🇷🇺 RU

Triage Info

Decided atMar 20, 2026
Published DateSep 18, 2013