What’s Vulnerable › Vulnerabilities

CVE-2013-5135

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-10-24 · updated 2026-06-16
• Weakness: CWE-134

Description

Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple Remote Desktop before 3.5.4 allows remote attackers to execute arbitrary code via format string specifiers in a VNC username.

Affected products

• Apple Remote Desktop: through 3.5.3; 3.0.0, 3.1, 3.2, 3.2.1, 3.2.2, 3.3 (+6)
• macOS: through 10.8.5; 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5

References

• http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00007.html
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00008.html
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00007.html
• http://lists.apple.com/archives/security-announce/2013/Oct/msg00008.html

Get alerted when CVE-2013-5135 or the next vulnerability affects your stack