CVE-2013-0006

HIGH

8.8

CVSS Score

Published: January 9, 2013 at 06:00 PM UTC

Updated: June 16, 2026 at 11:48 PM UTC

15 products affected across 1 vendorWindows Server 2012Windows Server 2008Windows 7

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 28%

SSVC

No known exploit

Description

Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Expression Web · Microsoft

95%

2sp1

Groove Server · Microsoft

95%

2007 sp2 2007 sp3

Office · Microsoft

95%

2003 sp3 2007 sp2 2007 sp3

Office Compatibility Pack · Microsoft

95%

sp2sp3

SharePoint Server · Microsoft

95%

2007 sp2 2007 sp3

Windows 7 · Microsoft

95%

sp1

Windows 8 · Microsoft

95%

All versions

Windows Rt · Microsoft

95%

All versions

Windows Server 2003 · Microsoft

95%

sp2

Windows Server 2008 · Microsoft

95%

r2sp2

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002

References (4)

Third Party Advisoryx_refsource_CERTUS Government Resource

Source: [email protected]

http://www.us-cert.gov/cas/techalerts/TA13-008A.html

Vendor Advisoryx_refsource_MS

Source: [email protected]

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002

VDB EntrySignaturex_refsource_OVAL

Source: [email protected]

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16429

x_refsource_MISC

Source: [email protected]

https://us-cert.cisa.gov/ics/advisories/icsa-20-315-01

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-189

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card