CVE-2013-1493: Oracle Java 2D CMM raster parameter flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityRemote, unauthenticated code execution in Java with in-the-wild exploitation, a public exploit and a CVSS 2.0 score of 10 warrants critical priority despite the absence of a KEV listing.

What it is

The color management (CMM) functionality in the 2D component of Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier mishandles crafted raster parameters in an image, triggering an out-of-bounds read or memory corruption in the JVM. This is a remotely reachable memory-safety flaw that was exploited in the wild in February 2013, so unpatched Java runtimes remain a serious risk.

Impact

An attacker can execute arbitrary code in the context of the JVM process or crash it, giving full compromise of the host running the vulnerable Java version. The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C reflects complete confidentiality, integrity and availability impact with no authentication.

Attack surface

Reachable over the network with no authentication and no user interaction beyond loading the crafted image content, per the AV:N/AC:L/Au:N vector. In practice this is delivered through Java applets or other image-processing paths in the JVM.

Exploitation

Exploited in the wild in February 2013 according to the description, and a public Exploit-DB entry (24904) exists; the record is not listed in CISA KEV, while EPSS is very high at 0.86151 (99.72nd percentile).

What to do

• Patch Java to a version after 7 Update 15, 6 Update 41 or 5.0 Update 40, or apply the vendor advisories (Oracle alert, Red Hat RHSA, Ubuntu USN, openSUSE, Gentoo, Mandriva) for the affected distribution.
• Remove or disable the Java browser plug-in and block applet execution where Java is not required.
• Restrict outbound and inbound access to Java-dependent services and enforce least privilege on any host still running a vulnerable JRE/JDK.
• Where legacy Java must remain, isolate it in a low-privilege sandbox or dedicated host and monitor for JVM crashes or unexpected child processes.

Detection

• Hunt for JVM crash events or hs_err logs referencing the 2D/CMM code paths or out-of-bounds reads.
• Monitor for Java processes spawning unexpected child processes such as cmd.exe, powershell.exe or /bin/sh.
• Inspect proxy and email logs for image files delivered to Java applet or image-processing endpoints, and alert on applet loads from untrusted origins.
• Track hosts still reporting Java 7 Update 15, 6 Update 41, 5.0 Update 40 or earlier via software inventory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.