CVE-2013-0648: Adobe Flash Player Code Execution Vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-09-17
EPSS: 11.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-02-27 · updated 2026-06-16

Description

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Affected products

Adobe Flash Player 24.0.0.186 and earlier.: before 10.3.183.67; from 11.0 before 11.6.602.171; from 11.0 before 11.2.202.273 — fixed in 10.3.183.67, 11.2.202.273, 11.6.602.171
Opensuse: 11.4, 12.1
RedHat Enterprise Linux Desktop: 6.0
RedHat Enterprise Linux Eus: 5.9, 6.4
RedHat Enterprise Linux Server: 6.0
RedHat Enterprise Linux Server Aus: 5.9, 6.4
RedHat Enterprise Linux Workstation: 6.0
SUSE Linux Enterprise Server 15 SP1: 10-sp4, 11-sp2

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 10.3.183.67, 11.2.202.273, 11.6.602.171. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2013-0648 or the next vulnerability affects your stack