Actively exploited in the wild
Microsoft Internet Explorer Resource Management Errors Vulnerability
Microsoft - Internet Explorer · Listed in the CISA KEV since 2025-08-12. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2013-3893
HighCVSS 8.8KEVSummary
Podatność typu use-after-free w implementacji SetMouseCapture w mshtml.dll w Microsoft Internet Explorer od wersji 6 do 11 umożliwia zdalnym atakującym wykonanie dowolnego kodu za pomocą spreparowanych ciągów JavaScript. Przykładem jest użycie adresu URL ms-help:, który wywołuje załadowanie hxds.dll.
Risk Assessment
Wykorzystanie tej podatności może prowadzić do zdalnego wykonania kodu, co stwarza poważne zagrożenie dla bezpieczeństwa systemów korzystających z Internet Explorera. Atakujący mogą przejąć kontrolę nad systemem ofiary.
Recommendation
Zaleca się aktualizację przeglądarki Internet Explorer do najnowszej wersji oraz rozważenie zastosowania alternatywnych przeglądarek, aby zminimalizować ryzyko związane z tą podatnością.
Related vulnerabilities
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
- CVE-2026-76949Critical
A vulnerability in the ash_authentication library (Elixir) allows an attacker who can plant a remember-me cookie in a victim's browser to replace the victim's authenticated session with one for the attacker's own account. The issue stems from a mismatch between the session keys used by the guard and the reader, causing remember-me sign-in to run on every request.
Original NVD description (English source)
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.