CVE-2013-3893
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft...
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
Exploit likelihood
What each source reports
CVE List
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
- Record
CVE-2013-3893- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2013-3825
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
- Record
EUVD-2013-3825- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7jff-7vvq-8fxx
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft...
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
- Record
GHSA-7jff-7vvq-8fxx- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Internet Explorer Resource Management Errors Vulnerability
Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Record
CVE-2013-3893- Weakness
- CWE-399
- Updated
- 2026-11-02
NVD
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
- Record
CVE-2013-3893- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free | 2013-09-17 |
| Exploit-DB | Micorosft Internet Explorer - SetMouseCapture Use-After-Free (Metasploit) | 2013-10-02 |
| Exploit-DB | Microsoft Internet Explorer 8 - 'SetMouseCapture ' Use After Free | 2021-05-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-3893 is a high vulnerability (CVSS 9.3) in Microsoft Internet Explorer, published September 18, 2013. CISA lists it as known to be exploited, since August 12, 2025. EUVD reports exploitation since August 12, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 87.6%, the 99th percentile. No source names a fixed version.
References
jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000093.html
jvn.jp/en/jp/JVN27443259/index.html
blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx
securityfocus.com/bid/62453
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18665
us-cert.gov/ncas/alerts/TA13-288A
Show 8 moreShow less
technet.microsoft.com/security/advisory/2887505
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080
pastebin.com/raw.php?i=Hx1L5gu6
packetstormsecurity.com/files/162585/Microsoft-Internet-Explorer-8-SetMouseCapture-Use-After-Free.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3893
nvd.nist.gov/vuln/detail/CVE-2013-3893
github.com/advisories/GHSA-7jff-7vvq-8fxx