ZeroDay Findings
Sign inSign up

Findings

CVE-2013-0074

Microsoft Silverlight Double Dereference Vulnerability

Published Mar 12, 2013 · updated Aug 13, 2026 · microsoft silverlight

Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

Timeline

Detection, updates, and resolution for this record.

  1. Mar 12, 2013 · Catalog

    Detected

    Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

  2. May 25, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. Jun 15, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Aug 13, 2026 · Catalog

    Updated

    Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date Jun 15, 2022

Affected

  • cpe microsoft/silverlightversion unspecified
  • vendor Microsoft Silverlightversion unspecified

Sources

  • CISA KEVCVE-2013-0074

    Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.

    cisa.gov
  • CVE.orgCVE-2013-0074

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2013-0074

    30-day exploitation probability 78.9%

    first.org
  • Exploit Database29858

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database41702

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_windows/browser/ms13_022_silverlight_script_object

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2013-0074

    Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability.

    nvd.nist.gov

References