CVE-2013-0648: Adobe Flash Player Code Execution Vulnerability
Vulnerability summary
CVE-2013-0648 is a high (CVSS 9.3) vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 17-09-2024. EPSS estimates a 11.09% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-02-2013PublishedVulnerability first disclosed.
- 17-09-2024Added to CISA KEVAdobe Flash Player Code Execution Vulnerability
- 08-10-2024CISA remediation dueThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- 12-01-2026Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
11.09%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.09% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 17-09-2024
- Federal due date
- 08-10-2024
CISA required action
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. www.adobe.com/products/flashplayer/end-of-life-alternative.html nvd.nist.gov/vuln/detail/CVE-2013-0648
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat5 products
Adobe1 product
- flash_player< 10.3.183.67 | ≥ 11.0, < 11.6.602.171 | ≥ 11.0, < 11.2.202.273
Opensuse1 product
- opensuseEOL11.4 | 12.1
Suse1 product
- linux_enterprise_desktop10:sp4 | 11:sp2
4 vendors · 8 products
References
6 links- www.adobe.com/support/security/bulletins/apsb13-08.htmlX Refsource CONFIRMBroken LinkPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing List
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0648Government ResourceUS Government Resource