CVE-2013-5331: Adobe Flash Player and AIR type confusion allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityThe vulnerability allows remote code execution, was exploited in the wild, and has a very high EPSS score, making it an urgent risk for any unpatched system.

What it is

Adobe Flash Player, Adobe AIR, and the AIR SDK contain an unspecified type confusion flaw that can be triggered by crafted .swf content. Successful exploitation allows remote attackers to execute arbitrary code on the affected system. The issue was exploited in the wild in December 2013, making it a serious risk for unpatched installations.

Impact

An attacker can execute arbitrary code with the privileges of the user running the vulnerable Adobe product. This could lead to full system compromise, data theft, or installation of malware.

Attack surface

The vulnerability is reachable remotely over the network by delivering a malicious .swf file to the victim, typically via a web page or email. No authentication is required, but user interaction (opening the file or visiting a malicious page) is needed to trigger the flaw.

Exploitation

The description states the flaw was exploited in the wild in December 2013. It is not listed in CISA KEV, but EPSS indicates a high probability of exploitation activity (0.72495, 99.4th percentile).

What to do

• Apply the vendor patch by updating Adobe Flash Player to version 11.7.700.257 or later on Windows/Mac, 11.9.900.170 or later for 11.8.x/11.9.x, and 11.2.202.332 or later on Linux; update Adobe AIR and AIR SDK to 3.9.0.1380 or later.
• If patching is not immediately possible, disable or remove Adobe Flash Player and AIR where they are not required.
• Configure browsers to require click-to-play for Flash content to reduce automatic exploitation.
• Apply the third-party patches referenced in the advisory (e.g., Red Hat, openSUSE) for Linux distributions.

Detection

• Monitor for the execution of suspicious .swf files, especially those delivered via email or downloaded from untrusted sites.
• Look for unexpected child processes spawned by Flash Player or AIR (e.g., cmd.exe, powershell.exe) that may indicate code execution.
• Review network traffic for known Flash exploit kit patterns or malicious .swf payloads.
• Check endpoint logs for crashes or memory corruption in Flash Player processes that could indicate exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.