CVE-2013-2465: Oracle Java SE JRE 2D sandbox bypass and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityCVSS 9.8, CISA KEV listing with known ransomware use, and a 0.987 EPSS probability make this an actively exploited remote code execution flaw.

What it is

CVE-2013-2465 is an unspecified vulnerability in the 2D component of Oracle Java SE JRE (7 Update 21 and earlier, 6 Update 45 and earlier, 5.0 Update 45 and earlier, and OpenJDK 7). Oracle's advisory gives no technical detail, but a third-party vendor claims it allows remote attackers to bypass the Java sandbox via incorrect image channel verification in 2D. Because it is remotely reachable without authentication and can affect confidentiality, integrity and availability, it is a serious client-side risk.

Impact

An attacker can escape the Java sandbox and run code with the privileges of the JVM process, gaining full control of confidentiality, integrity and availability on the host. In practice this means arbitrary code execution on any machine that loads the malicious Java content.

Attack surface

Reached over the network (AV:N) with no privileges and no user interaction required per the CVSS vector, typically by delivering malicious Java content to a JRE. The description does not specify the exact delivery path, so the vector is inferred from the CVSS metrics rather than stated in the record.

Exploitation

CVE-2013-2465 is listed in CISA KEV (added 2022-03-28, due 2022-04-18) with known ransomware campaign use, and EPSS gives a 30-day probability of 0.987 (99.9th percentile). The record contains no exploit code or public PoC reference, but KEV and EPSS indicate active exploitation.

What to do

• Apply the vendor updates referenced in the Oracle June 2013 CPU advisory and the OpenJDK patch; this is the only complete fix.
• Upgrade to a supported Java release; Java 7 Update 21, 6 Update 45 and 5.0 Update 45 and earlier are affected.
• If legacy Java cannot be removed, disable the Java browser plug-in and block execution of untrusted JAR/applet content.
• Apply the Linux distribution errata (Red Hat, SUSE, Gentoo, Mandriva) for hosts running the bundled JRE.
• Restrict outbound and inbound paths that deliver Java content to reduce exposure until patching completes.

Detection

• Hunt for JRE versions at or below 7u21, 6u45 and 5.0u45 on endpoints and servers, including bundled JREs in third-party software.
• Monitor for unexpected child processes spawned by java/javaw, especially browsers or office applications launching Java.
• Alert on Java processes making outbound network connections or writing executables to user-writable directories.
• Review proxy and IDS logs for delivery of JAR or applet content from untrusted or newly seen hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.