Microsoft Silverlight Double Dereference Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 12, 2013 · Catalog

   Detected

   Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

2. May 25, 2022 · CISA KEV

   Known exploited

   The impacted product is end-of-life and should be disconnected if still in use.

3. Jun 15, 2022 · CISA KEV

   Remediation due

   The impacted product is end-of-life and should be disconnected if still in use.

4. Aug 13, 2026 · Catalog

   Updated

   Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

Affected

• cpe microsoft/silverlightversion unspecified
• vendor Microsoft Silverlightversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2013-0074

  Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.

  cisa.gov
• CVE.orgVulnerability recordCVE-2013-0074

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2013-0074

  30-day exploitation probability 78.9%

  first.org
• Exploit DatabasePublic exploit reference29858

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit DatabasePublic exploit reference41702

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit ModulesPublic exploit moduleexploit_windows/browser/ms13_022_silverlight_script_object

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2013-0074

  Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability.

  nvd.nist.gov

References

• Third Party Advisory · us-cert.gov
• Patch · docs.microsoft.com
• CISA note · nvd.nist.gov
• Broken Link · oval.cisecurity.org
• Broken Link · oval.cisecurity.org