Log in Start free

Actively exploited · Published Feb 27, 2013 · Assigned by adobe

CVE-2013-0648

High 8.8 Exploited

In plain English

A high-severity security flaw in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on September 17, 2024). The chance it is exploited in the next 30 days is estimated at 11.1% (higher than 96% of all known vulnerabilities). The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)11.1%top 4.1% of all CVEs
Exploited in the wildYesCISA KEV since Sep 17, 2024
Attack toolingNoneno public tooling known

CISA guidance

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Federal agencies must remediate by Oct 8, 2024.

Official description

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References