{"id":"CVE-2013-3894","published":"2013-10-09T14:44:00Z","modified":"2025-01-16T20:15:33Z","title":"The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted CMAP table in a TrueType font (TTF) file, aka \"TrueType Font CMAP Table Vulnerability.\"","provenance":"source","from":"CVE.org"},"summary":{"text":"The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT contain a flaw in how they process the CMAP table of TrueType font (TTF) files, classified as improper control of code generation. A remote attacker can execute arbitrary code by supplying a crafted TTF file, with the attack vector being network-reachable and no privileges or user interaction required, though exploitation is noted as having high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:21:54Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.43101,"percentile":0.98722,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2015-02-01","exploitedFirstSeen":"2015-02-01","ransomware":false,"evidence":[{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf","date":"2015-02-01"},{"url":"https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Equation_Group_866e8d2944.pdf","date":"2022-11-15"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"CVE -CVE Reference Map for Source MS - Curios RE active candidates CVE version 20061101","url":"https://otx.alienvault.com/pulse/679c3446de4f362fac9217f9","created":"2025-01-31"},{"name":"APT31 Stole and Used an Unknown Equation Group 0-Day","url":"https://otx.alienvault.com/pulse/6033e08d756155d3fc8d8f1c","created":"2021-02-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18899","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081","tags":["vendor-advisory","x_refsource_MS"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA13-288A","tags":["third-party-advisory","x_refsource_CERT"]}],"techniques":[],"reports":[{"id":"SRC-6455ab6c9917b3700d6d","title":"Version: 1.5","publisher":"media.kasperskycontenthub.com","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf","date":null,"mentions":[{"quote":"• TTF exploit fixed with MS13-081 (possibly CVE-2013-3894).","start":14456,"end":14515}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2013-3826","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-3826","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2013-10-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2013-3894","provenance":"source"},{"date":"2015-02-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":65.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4290 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.74,"detail":"percentile 0.9872"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}