CVE-2013-3870
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote...
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
- Record
CVE-2013-3870- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
- Record
CVE-2013-3870- Updated
- 2026-11-02
EUVDEUVD-2013-3802 No score
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
- Record
EUVD-2013-3802- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m4gr-fj9h-9vrx No score
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote...
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
- Record
GHSA-m4gr-fj9h-9vrx- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-3870 is a high vulnerability (CVSS 9.3) in Microsoft Outlook, published September 11, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 18.6%, the 97th percentile. No source names a fixed version.
References
blogs.technet.com/b/srd/archive/2013/09/10/assessing-risk-for-the-september-2013-security-updates.aspx
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18857
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-068
us-cert.gov/ncas/alerts/TA13-253A
nvd.nist.gov/vuln/detail/CVE-2013-3870
github.com/advisories/GHSA-m4gr-fj9h-9vrx