High severity7.8CISA KEVNVD Advisory· Published May 24, 2013· Updated Jun 16, 2026
CVE-2013-3660
CVE-2013-3660
Description
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11- cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*+ 1 more
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*+ 1 more
- cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*
- cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
15- docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053nvdPatchVendor Advisory
- twitter.com/taviso/statuses/309157606247768064nvdExploit
- www.exploit-db.com/exploits/25611/nvdExploitThird Party AdvisoryVDB Entry
- www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/nvdExploitIssue Tracking
- secunia.com/advisories/53435nvdBroken LinkVendor Advisory
- www.us-cert.gov/ncas/alerts/TA13-190AnvdThird Party AdvisoryUS Government Resource
- archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.htmlnvdBroken Link
- archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.htmlnvdBroken Link
- archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.htmlnvdBroken Link
- twitter.com/taviso/statuses/335557286657400832nvdNot Applicable
- www.computerworld.com/s/article/9239477nvdBroken Link
- www.osvdb.org/93539nvdBroken Link
- www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flawnvdPress/Media Coverage
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360nvdBroken Link
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.