ACTIVELY EXPLOITED
CVE-2013-3896: Microsoft Silverlight Information Disclosure Vulnerability
| Vendor | Microsoft |
|---|---|
| Product | Silverlight |
| Actively exploited | Yes |
| Added to CISA KEV | 25 May 2022 |
| CISA federal deadline | 15 Jun 2022 |
| Weakness (CWE) | CWE-20 |
Required action (CISA's text)
The impacted product is end-of-life and should be disconnected if still in use.
Description (NVD)
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
SOURCES
Other Microsoft flaws
- patchtuesday:2026-11: Vulnerability in Microsoft
- CVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
- CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
- CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.