Technical intelligence and weaponization dossier for CVE-2013-3881. Documented exploitation across 1 active malware families totaling 25 analyzed telemetry samples.
| Vulnerability ID | CVE-2013-3881 |
|---|---|
| Common Name / Bulletin | Microsoft Windows Kernel GDI Font Parsing Local Privilege Escalation (MS13-081) |
| CWE Classification | CWE-119: Memory Corruption in Win32k |
| Affected Software & Versions | Microsoft Windows Vista, 7, 8, Server 2008, Server 2012 |
| Technical Root Cause | Flaw in Win32k.sys handling font tables allowing ring-0 elevation of privilege, utilized by Equation Group / EquationDrug malware modules. |
| Associated ATT&CK Techniques |
|
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| equationdrug | Advanced Threat | 25 | Trojan:Win32/EquationDrug is a state-of-the-art cyber-espionage platform attributed by global threat intelligence researchers to the Equation Group (associated ... |
Threat intelligence confirms the following adversaries weaponize CVE-2013-3881 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2013-3881 in enterprise networks:
Non-privileged processes invoking CreateFontIndirect() or AddFontMemResourceEx() leading to immediate elevation to NT AUTHORITY\SYSTEM.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →