ZeroDay Findings
Sign inSign up

Findings

CVE-2013-3906

Microsoft Graphics Component Memory Corruption Vulnerability

Published Nov 6, 2013 · updated Jun 16, 2026 · n/a n/a

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 6, 2013 · Catalog

    Detected

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

  2. Feb 15, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Aug 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Required action

Apply updates per vendor instructions.

CISA due date Aug 15, 2022

Affected

  • cpe microsoft/excel viewerversion unspecified
  • cpe microsoft/lync2010
  • cpe microsoft/lync2013
  • cpe microsoft/office2003
  • cpe microsoft/office2007
  • cpe microsoft/office2010
  • cpe microsoft/office compatibility packversion unspecified
  • vendor Microsoft Graphics Componentversion unspecified
  • vendor n/a n/aversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2013-3906

    Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2013-3906

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2013-3906

    30-day exploitation probability 84.9%

    first.org
  • Exploit DatabasePublic exploit reference30011

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_windows/fileformat/mswin_tiff_overflow

    Public module reference (average). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2013-3906

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated

    nvd.nist.gov

References