How to Fix CVE-2013-3896: Silverlight Information Disclosure

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-05-25, federal due date 2022-06-15.

What is CVE-2013-3896?

CVE-2013-3896 is an information-disclosure vulnerability in Microsoft Silverlight 5, the browser plug-in Microsoft shipped for rich web applications (the same runtime that powered older Netflix and enterprise line-of-business players). Every Silverlight 5 build before 5.1.20913.0 is affected on both Windows and Mac.

The root cause is that Silverlight does not properly validate pointers when it accesses Silverlight elements. A crafted Silverlight application can abuse that improper validation to read memory it should not be able to reach, leaking sensitive information out of the affected process. Microsoft tracked it as the “Silverlight Vulnerability” in bulletin MS13-087.

This is not remote code execution and it is not a privilege-escalation bug. The CVSS 3.1 vector the CISA ADP container assigns — AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5 — tells the whole story: the impact is confined to confidentiality (C:H), with no integrity or availability impact (I:N/A:N), and it requires user interaction (UI:R). In practice the “interaction” is a user visiting a web page that hosts the malicious Silverlight content. The payoff for the attacker is leaked memory, which can include data that defeats ASLR and makes a second, separate exploit reliable. That chaining value is exactly why a confidentiality-only bug ended up being exploited in the wild.

Why this CVE matters

CISA added CVE-2013-3896 to the Known Exploited Vulnerabilities catalog on 2022-05-25, which means working attack code has been used against real targets. Silverlight is a client-side plug-in, so the exposure is on user endpoints, not servers: any Windows or Mac machine that still has Silverlight 5 installed and a browser that can still load it is reachable through a hostile web page. Because the bug leaks memory rather than crashing anything, exploitation is quiet — there is no obvious symptom to alert the user or an administrator. If you still have vulnerable Silverlight installed anywhere in your fleet, treat each of those endpoints as having been exposed during any browsing the user did, and prioritise removal.

Check whether you are affected

Silverlight is a Windows and Mac browser plug-in — there is no Linux package, so package managers like dpkg, rpm, apt, or yum are irrelevant here. On Windows, read the installed Silverlight build directly from the registry. If it is below 5.1.20913.0, the fix applies to you.

# Windows: read the installed Silverlight version
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Silverlight' -Name Version -ErrorAction SilentlyContinue |
    Select-Object Version
# 64-bit Windows also keeps a WOW6432Node copy for the 32-bit plug-in:
Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Silverlight' -Name Version -ErrorAction SilentlyContinue |
    Select-Object Version

If either query returns a Version below 5.1.20913.0 (for example 5.1.20125.0), you are running a vulnerable build. On a Mac, open System Preferences → Silverlight and read the version on the About tab, or check /Library/Internet Plug-Ins/Silverlight.plugin. If Silverlight does not appear at all, nothing on that machine is exposed to this CVE.

How to fix CVE-2013-3896

The fix is to update Silverlight to 5.1.20913.0 or later, the build Microsoft shipped in MS13-087 (KB2890788) on 8 October 2013. There is no configuration toggle and no registry workaround that closes this bug — only the updated binary does. You have two realistic choices: update to the fixed build, or remove Silverlight entirely. Given that Microsoft ended Silverlight support on 12 October 2021 and modern browsers (Chrome, Edge, Firefox) dropped NPAPI/plug-in support years ago, removal is the better answer for almost everyone. Update only if a specific legacy application genuinely still requires Silverlight.

Option A — remove Silverlight (recommended)

Silverlight is end-of-life and almost nothing on the modern web needs it. Uninstalling removes the attack surface completely.

# Windows (run as administrator): find and uninstall Silverlight
$sl = Get-Package -Name 'Microsoft Silverlight' -ErrorAction SilentlyContinue
if ($sl) { Uninstall-Package -Name 'Microsoft Silverlight' -Force }

# If Get-Package does not find it, uninstall the MSI by product code from the registry:
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
              'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' |
    ForEach-Object { Get-ItemProperty $_.PSPath } |
    Where-Object { $_.DisplayName -like '*Silverlight*' } |
    ForEach-Object { Start-Process msiexec.exe -ArgumentList "/x $($_.PSChildName) /qn /norestart" -Wait }

On a Mac, run the uninstaller Microsoft shipped, or delete the plug-in bundle:

# macOS: remove the Silverlight browser plug-in
sudo rm -rf "/Library/Internet Plug-Ins/Silverlight.plugin"
sudo rm -rf "/Library/Application Support/Microsoft/Silverlight"

Option B — update to 5.1.20913.0 (only if an app still needs Silverlight)

The patched build is delivered through Windows Update / Microsoft Update as part of the October 2013 security updates. On a supported, patched machine it will already be present; on an old or offline image you can install it directly. Silverlight is a standalone MSI, not a Windows hotfix, so there is no wusa.exe/MSU step and no Get-HotFix KB to chase — you update the application itself.

# Windows: let Windows Update pull the Silverlight 5.1.20913.0 update
# (Settings > Update & Security > Check for updates), or install the
# standalone installer Microsoft signed for 5.1.20913.0 or later:
Start-Process .\Silverlight_x64.exe -ArgumentList '/q' -Wait   # 64-bit
# 32-bit plug-in:
Start-Process .\Silverlight.exe     -ArgumentList '/q' -Wait

The installer replaces the in-place plug-in. Fully close and reopen the browser afterwards so the old plug-in is unloaded from memory — an open browser keeps the vulnerable build mapped until it restarts.

If you can't update or remove it immediately

This is a client-side plug-in bug triggered by browsing to hostile content, so the only meaningful interim mitigation is to stop the plug-in from running. Firewall or network rules do nothing here — the attack arrives over ordinary web traffic the user requested.

• Disable the Silverlight add-on in the browser until you can update or remove it. In legacy Internet Explorer this is Tools → Manage add-ons → disable Microsoft Silverlight.
• Set the kill bit / block the plug-in via Group Policy across the fleet so users cannot re-enable it.
• Steer users to a browser that cannot load Silverlight at all (current Chrome, Edge, or Firefox), which neutralises the web-delivered attack path regardless of what is installed.

Verify the fix landed

After updating or removing, re-read the version straight from the registry on Windows. If you updated, the value must be 5.1.20913.0 or higher; if you removed it, the key should be gone entirely.

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Silverlight' -Name Version -ErrorAction SilentlyContinue |
    Select-Object Version
Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Silverlight' -Name Version -ErrorAction SilentlyContinue |
    Select-Object Version

For a definitive answer, browse to Microsoft's “Get Microsoft Silverlight” detection page in the affected browser, or run an authenticated vulnerability scan and confirm the scanner no longer flags CVE-2013-3896. Because this CVE is on the CISA KEV list, do not stop at the patched build: on any endpoint that ran the vulnerable plug-in while reachable, review what the user browsed during the exposure window and treat memory-resident secrets on that machine as potentially read.

Frequently asked questions

Which Silverlight version fixes CVE-2013-3896?

Silverlight 5.1.20913.0, released on 8 October 2013 in bulletin MS13-087 (KB2890788). Any Silverlight 5 build below 5.1.20913.0 is vulnerable on both Windows and Mac. Updating to that build or anything newer closes the bug; there is no registry or configuration workaround.

Is CVE-2013-3896 remote code execution?

No. It is an information-disclosure bug. Silverlight fails to validate pointers when accessing Silverlight elements, so a crafted Silverlight application can read sensitive data out of memory. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) shows confidentiality impact only, with no integrity or availability impact. The danger is that leaked memory can defeat ASLR and make a separate exploit reliable.

Should I update Silverlight or just remove it?

Remove it, in almost every case. Microsoft ended Silverlight support on 12 October 2021, and modern browsers no longer load it, so uninstalling eliminates the attack surface with no downside for normal users. Update to 5.1.20913.0 only if a specific legacy line-of-business application still depends on Silverlight.

It is being exploited in the wild — how urgent is this?

CISA added CVE-2013-3896 to the Known Exploited Vulnerabilities catalog on 2022-05-25, with a federal remediation deadline of 2022-06-15, so working attack code exists. The exposure is on user endpoints reached through a malicious web page, and exploitation is silent because it only reads memory. Treat any machine still running a vulnerable Silverlight build as a priority for removal or update.

References

• Official vendor advisory: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2013-3896
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3896
• Additional reference: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003
• Additional reference: http://www.us-cert.gov/ncas/alerts/TA13-288A
• Additional reference: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19055
• Additional reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3896

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2013-3660: Memory Corruption in Microsoft Win32k
• How to Fix CVE-2013-7331: Generation of Error Message Containing Sensitive Information in Internet Explorer
• How to Fix CVE-2013-1331: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Office
• How to Fix CVE-2013-0074: Security Vulnerability in Silverlight
• How to Fix CVE-2013-3897: Use-after-free in Internet Explorer