‹ Back to list

CVE-2013-4988

Status: ModifiedHigh (9.3)—Exploit
Severity9.3High · CVSS 2.0
Exploitation probability67 %higher than 99% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailablePublished on Exploit-DB · Metasploit module (reliable, widely available exploit)

Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file. NOTE: some of these details are obtained from third party information.

CVSS

Base score
9.3
Version
2.0
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
67 %
Percentile among all scored CVEs
99
Score date
11/1/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Affected technologies (1)

Icofx — Icofx

CWEs

References

Show 20 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2013-4988",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-12-13T18:07:51.373",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2013-12/0046.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/100826",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/124380/IcoFX-2.5.0.0-Buffer-Overflow.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/162995/IcoFX-2.6-Buffer-Overflow.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2013/Dec/54",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/55964",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.coresecurity.com/advisories/icofx-buffer-overflow-vulnerability",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/30208",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/64221",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89611",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2013-12/0046.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/100826",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/124380/IcoFX-2.5.0.0-Buffer-Overflow.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/162995/IcoFX-2.6-Buffer-Overflow.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2013/Dec/54",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/55964",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.coresecurity.com/advisories/icofx-buffer-overflow-vulnerability",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/30208",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/64221",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89611",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Buffer overflow de pila en IcoFX 2.5 y anteriores permite a atacantes remotos ejecutar código de forma arbitraria a través de un valor idCount largo en una estructura ICONDIR en un archivo ICO.\nNOTA: Algunos de estos detalles han sido obtenidos de terceras partes."
    }
  ],
  "lastModified": "2026-06-16T23:58:12.987",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:icofx:icofx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A644399-B178-4C2D-B581-2F221FF89C30",
              "versionEndIncluding": "2.5"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94267A33-6808-4CB0-A88C-EF03BA96CF19"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:1.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68E5004A-9972-4D12-B26E-D9DA3F003DB3"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:1.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F31C6390-5303-450A-B40F-BA6113755CB3"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:1.6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DF9D133-DFDD-47D8-8D1D-9C403B26D6FF"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:1.6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0741A995-D610-4783-A02E-5C70E3CBA7BE"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F68494D-C223-4130-B788-C239D6B4DD40"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1B7D6B1-F722-4796-AA5B-BCF714D81038"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1F1A18E-14D3-4FFF-995C-C21FAEDFEF95"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D37DC35-36C0-4629-B182-B27092996246"
            },
            {
              "criteria": "cpe:2.3:a:icofx:icofx:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02EB38CA-40E2-44C1-A589-FFD8E72E1410"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}