CVE-2013-3896

MediumPublished

Microsoft Silverlight Information Disclosure Vulnerability

Published: Oct 9, 2013
Updated: Oct 22, 2025
Assigning CNA: microsoft
Evidence observed: Mar 12, 2013

Primary CVSS

5.5/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS probability estimate

68.0%

High · next 30 days

Percentile: 99.3%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory AccessModule
modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: c3e1fbccdfb4Related tool
Declared conditions
- platform: Windows($.exploit_windows/browser/ms13_022_silverlight_script_object.platform)
- verification: check_not_declared($.exploit_windows/browser/ms13_022_silverlight_script_object.check)

Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)Exploit

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.