CVE-2013-0006
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content,...
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."
Exploit likelihood
What each source reports
CVE List
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."
- Record
CVE-2013-0006- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2013-0049
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."
- Record
EUVD-2013-0049- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jcp-w4pp-vm92
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content,...
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."
- Record
GHSA-4jcp-w4pp-vm92- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."
- Record
CVE-2013-0006- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
Affected products
- microsoft xml core services
- microsoft expression web
- microsoft groove server
- microsoft office
- microsoft office compatibility pack
- microsoft sharepoint server
- microsoft windows 7
- microsoft windows 8
- microsoft windows rt
- microsoft windows server 2003
- microsoft windows server 2008
- microsoft windows server 2012
Show 3 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0006 is a high vulnerability (CVSS 9.3) in Microsoft Xml Core Services, published January 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 28.1%, the 98th percentile. No source names a fixed version.
References
us-cert.gov/cas/techalerts/TA13-008A.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16429
us-cert.cisa.gov/ics/advisories/icsa-20-315-01
nvd.nist.gov/vuln/detail/CVE-2013-0006
github.com/advisories/GHSA-4jcp-w4pp-vm92