CVE-2013-0648KEV · OVERDUE

Adobe Flash Player Code Execution Vulnerability

High · published February 27, 2013

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.9th percentile for exploit probability.

745
days past CISA
deadline
CVSS v3.1
8.8
EPSS
11%
Percentile
95.9
In the wild
Confirmed
What it is

🚨 A crafty SWF file is all it takes to exploit this Adobe Flash Player vulnerability, allowing attackers to slide right in and execute arbitrary code! 🔥 Think of it like a restaurant where a waiter accepts any order without verifying it — if the kitchen isn’t careful, they’ll whip up whatever chaos the customer requests! 🍽️ This vulnerability could lead to absolute devastation: an attacker could gain control over your system, stealing sensitive data or deploying malware without you even knowing! The consequences could range from data loss to complete system compromise.

Put simply

Think of it like a restaurant where a waiter accepts any order without verifying it — if the kitchen isn’t careful, they’ll whip up whatever chaos the customer requests! 🍽️ CVE-2013-0648 allows remote attackers to execute arbitrary code by exploiting the ExternalInterface ActionScript functionality in affected versions of Adobe Flash Player via crafted SWF content, making it a serious risk for users.

What to do

This vulnerability could lead to absolute devastation: an attacker could gain control over your system, stealing sensitive data or deploying malware without you even knowing! The consequences could range from data loss to complete system compromise. Update Adobe Flash Player to versions 10.3.183.67 or higher for Windows and Mac OS X, and 10.3.183.67 or 11.2.202.273 for Linux immediately. Remember, keeping software updated is your first line of defense! You've got this! Follow these steps and you'll be the hero of your security story! 🦸‍♂️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.11094 · 95.9th percentile
Published
2013-02-27T00:00Z
KEV added
2024-09-17 · due 2024-10-08
EPSS history
Timeline
  • 17 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 8
    kev
  • 27 FEB 00:00Z
    Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows…
    cvelistv5