CVE-2013-0634: Adobe Flash Player memory corruption via crafted SWF content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution with confirmed in-the-wild exploitation and a very high EPSS score, though the product is legacy and largely retired.

What it is

Adobe Flash Player contains a memory corruption flaw (CWE-119) reachable through crafted SWF content. The description states it was exploited in the wild in February 2013, and it affects multiple platform-specific versions across Windows, Mac OS X, Linux and Android. Because Flash content is routinely embedded in web pages, this is a remotely reachable code execution issue with a broad install base.

Impact

An attacker can execute arbitrary code in the context of the Flash Player process, or crash it to cause a denial of service. Successful code execution typically gives the attacker the privileges of the user running the browser or Flash runtime.

Attack surface

Reached remotely over the network by delivering a malicious SWF file, for example via a web page or embedded content. The CVSS vector (AV:N/AC:M/Au:N) indicates no authentication is required and that some user action, such as loading the page or file, is needed.

Exploitation

The description explicitly states the flaw was exploited in the wild in February 2013. It is not listed in CISA KEV, but EPSS is very high (0.776, 99.5th percentile), consistent with active historical exploitation.

What to do

• Apply the vendor patch per Adobe security bulletin APSB13-04 and update to the fixed Flash Player versions listed for each platform.
• Apply the referenced Linux distribution updates (Red Hat RHSA-2013-0243 and openSUSE advisories) where Flash is packaged by the OS vendor.
• If Flash cannot be patched or is no longer needed, disable or uninstall Flash Player and block SWF content at the browser and proxy level.
• Restrict browsing to trusted sites and enforce click-to-play for plug-in content to reduce exposure to malicious SWF files.

Detection

• Monitor for Flash Player process crashes or memory corruption events, which may indicate exploitation attempts.
• Inspect proxy, IDS and web logs for SWF file downloads from untrusted or newly registered domains.
• Hunt for suspicious child processes spawned by browser or Flash Player processes, a common post-exploitation pattern.
• Review endpoint telemetry for anomalous behavior originating from the Flash Player process, such as unexpected network connections or file writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.