CVSS 9.3 CRITICAL Bulletin: MS13-098 Published: 2013-11-06

CVE-2013-3906: Microsoft Office & Windows GDI+ TIFF Parsing Remote Code Execution

Technical intelligence and weaponization dossier for CVE-2013-3906. Documented exploitation across 3 active malware families totaling 13 analyzed telemetry samples.

Attributed Families

Sample Volume

CVSS Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2013-3906
Common Name / Bulletin	Microsoft Office & Windows GDI+ TIFF Parsing Remote Code Execution (`MS13-098`)
CWE Classification	`CWE-119: Integer Overflow / Heap Corruption`
Affected Software & Versions	Microsoft Office 2003, 2007, 2010, Windows Vista, Server 2008
Technical Root Cause	Integer overflow in GDI+ (gdiplus.dll) when rendering malformed TIFF images embedded within Office documents, utilized by Carbanak and ZeusVM.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1566.001` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2013-3906

Empirical catalog telemetry verifies that the following 3 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

3 families

Malware Family	Category	Catalog Samples	Operational Profile
cryptolocker	Ransomware	`10`	CryptoLocker is the historic archetype of modern asymmetric ransomware, first discovered in September 2013. Engineered and operated under the criminal syndicate...
carbanak	Banking Trojan	`2`	Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware fram...
zeusvm	Banking Trojan	`1`	Trojan-Banker:Win32/ZeusVM (also widely tracked in underground forums as KINS) is a highly sophisticated banking trojan variant derived from the leaked Zeus 2.0...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2013-3906 in enterprise intrusions and campaign toolkits:

KINS Author — Attributed Threat Group / Campaign Operator
Zeus Derivative Developers — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2013-3906 in enterprise networks:

DOCX/DOC files containing embedded TIFF files with invalid StripByteCounts or RowsPerStrip parameters.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Deploy MS13-098; deploy Microsoft Fix it to disable TIFF codec in GDI+; enforce Protected View.

For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →

← Return to Vulnerability Matrix Directory (All 63 CVEs)