CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
Other sources
Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
At the perimeter and mail gateway, block, quarantine, or strip TIFF image attachments and Word documents with embedded images from untrusted or external sources to prevent delivery of crafted TIFF images that could exploit GDI+.
- Compensating control
Prevent automatic rendering/preview of images and disable automatic document preview for Microsoft Office documents (for example in mail clients or document viewers), and require documents from untrusted sources to be opened only in a sandbox or isolated environment.
- Operational
Monitor Microsoft security advisories and update sources for any released fixes addressing the Microsoft Graphics Device Interface/GDI+ memory corruption vulnerability, and apply relevant updates as soon as they are available.
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3906?
CVE-2013-3906 has a critical severity rating, allowing remote attackers to execute arbitrary code.
What are the affected software versions for CVE-2013-3906?
CVE-2013-3906 affects various Microsoft products, including Windows Vista SP2, Windows Server 2008 SP2, and multiple versions of Microsoft Office.
How do I fix CVE-2013-3906?
To fix CVE-2013-3906, apply the latest security updates and patches released by Microsoft for the affected software.
What type of attack does CVE-2013-3906 facilitate?
CVE-2013-3906 facilitates remote code execution attacks via crafted TIFF images.
Is CVE-2013-3906 still a risk today?
While CVE-2013-3906 was addressed in the past, systems still using vulnerable software without updates remain at risk.