CVE-2013-0648: Adobe Flash Player ExternalInterface ActionScript code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe vulnerability is in CISA KEV, was exploited in the wild, and allows remote code execution with high impact, though user interaction is required.

What it is

An unspecified vulnerability in the ExternalInterface ActionScript functionality of Adobe Flash Player allows remote attackers to execute arbitrary code via crafted SWF content. It affects Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux. The flaw was exploited in the wild in February 2013.

Impact

An attacker can execute arbitrary code in the context of the user running Flash Player, potentially leading to full system compromise. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact.

Attack surface

The vulnerability is reached remotely over the network by delivering crafted SWF content to a victim, typically via a web page or document. No authentication is required, but user interaction is needed to load and execute the malicious SWF.

Exploitation

The vulnerability is listed in CISA KEV (added 2024-09-17) and was exploited in the wild in February 2013. EPSS probability is 0.11094 (95.7th percentile), indicating a relatively high likelihood of exploitation activity.

What to do

• Apply the vendor patch referenced in Adobe security bulletin APSB13-08 or upgrade to a fixed Flash Player version.
• Discontinue use of Adobe Flash Player, as it is end-of-life and no longer supported; remove or disable the plugin where possible.
• If Flash cannot be removed immediately, restrict its execution to trusted sites and block untrusted SWF content at the network perimeter.
• Apply the relevant Linux distribution updates (Red Hat RHSA-2013-0574, openSUSE security announcements) for affected packages.

Detection

• Monitor for processes loading Flash Player (e.g., flash player plugin) spawning unusual child processes or making unexpected network connections.
• Inspect network traffic for SWF files delivered from untrusted sources, especially those invoking ExternalInterface calls.
• Review endpoint logs for crashes or memory corruption events in Flash Player processes that may indicate exploitation attempts.
• Use the CISA KEV catalog entry to prioritize scanning for unpatched Flash Player installations across the environment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.