CVE-2013-0073

The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly restrict the privileges of a callback function during object creation, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "WinForms Callback Elevation Vulnerability."

• CWE-264

• http://www.us-cert.gov/cas/techalerts/TA13-043B.htmlThird Party Advisory, US Government Resource
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-015
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16475
• http://www.us-cert.gov/cas/techalerts/TA13-043B.htmlThird Party Advisory, US Government Resource
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-015
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16475

Published

Feb 13, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0067Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-0068Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-0069Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-0070Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-0071Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-0072Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-0074Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1…7.8
• CVE-2013-0075The TCP/IP implementation in Microsoft Windows Vista SP2, Wi…
• CVE-2013-0076The Client/Server Run-time Subsystem (CSRSS) in Microsoft Wi…
• CVE-2013-0077Quartz.dll in DirectShow in Microsoft Windows XP SP2 and SP3…
• CVE-2013-0078The Microsoft Antimalware Client in Windows Defender on Wind…
• CVE-2013-0079Microsoft Visio Viewer 2010 SP1 allows remote attackers to e…