Adobe Flash Player: Four 2013-2014 Zero-Days Added to KEV

What to do

1. Inventory endpoints and golden images for any installed Flash Player, including standalone copies and plugins bundled with old browsers.
2. On Windows 10 and Windows Server 2012-2019 builds that shipped Flash, install KB4577586 to remove the Windows-bundled copy.
3. Uninstall every remaining standalone Flash Player; do not reinstall old builds to patch these CVEs.
4. If a legacy application truly cannot run without Flash, isolate that machine from web browsing and email and plan its replacement.
5. Block .swf downloads and Flash MIME types at web proxies where they serve no business purpose.

How to check if you are affected or compromised

• Check for Flash binaries: C:\Windows\System32\Macromed\Flash and SysWOW64\Macromed\Flash on Windows, /Library/Internet Plug-Ins/Flash Player.plugin on macOS, libflashplayer.so on Linux.
• Search EDR history on legacy hosts for processes spawned by browsers or plugin hosts such as Firefox's plugin-container.exe.
• Search mail and file stores for .docx files with embedded SWF content, the delivery method Kaspersky documented for CVE-2014-0497.

What happened#

Between February 2013 and February 2014, Adobe shipped three emergency Flash Player bulletins for four bugs that attackers were already using.

• APSB13-08 (Feb 26, 2013) fixed CVE-2013-0643, a permissions flaw in Flash's Firefox sandbox, and CVE-2013-0648, a bug in the ExternalInterface ActionScript feature. Adobe said both were exploited "in targeted attacks" that lured users to a site serving malicious SWF content, and that the exploit was built to target Firefox.
• APSB14-04 (Feb 4, 2014) fixed CVE-2014-0497, an integer underflow reported by Kaspersky. Kaspersky found 11 exploits embedded in .docx files with Korean-language names. The victims appeared to be in China, and one payload included a spy tool that stole mailbox passwords.
• APSB14-07 (Feb 20, 2014) fixed CVE-2014-0502, a double free credited to the Google Security Team and FireEye. FireEye called the campaign Operation GreedyWonk. According to InfoWorld, three nonprofit policy sites redirected visitors through a hidden iframe to the exploit server. FireEye said the attackers "appear to be Chinese speakers."

On September 17, 2024, CISA added all four to the KEV catalog "based on evidence of active exploitation," with an October 8, 2024 deadline. Because the product is end of life, the required action is to stop using it. NVD and CISA score each bug CVSS 3.1 8.8.

Who is affected#

Only Flash builds from before each fix: before 11.6.602.171 on Windows and Mac for the 2013 pair, before 12.0.0.44 for CVE-2014-0497, and before 12.0.0.70 for CVE-2014-0502. Linux and Adobe AIR had their own fixed builds, listed above. The Adobe EOL page says Adobe stopped supporting Flash Player after December 31, 2020, and "blocked Flash content from running in Flash Player beginning January 12, 2021." It "strongly recommends all users immediately uninstall Flash Player."

Do you really need to act?#

Almost certainly not. CISA did not explain why it listed these bugs in 2024. We found no report of a new campaign using them as of October 23, 2026. The only documented exploitation is the zero-day use in 2013 and 2014. A successful attack today needs a 2013 or early-2014 Flash build, plus a browser that still loads plugins. Current browsers do not.

The real exposure is legacy machines: frozen VM images, kiosks, lab PCs or industrial workstations with an old browser and Flash still installed. On those machines the problem is bigger than these four CVEs. Flash has had no security updates since 2020, so any copy should go.

What to do now#

1. Inventory. On Windows, check dir C:\Windows\System32\Macromed\Flash C:\Windows\SysWOW64\Macromed\Flash. On macOS, run ls "/Library/Internet Plug-Ins/" | grep -i flash. On Linux, run find / -name libflashplayer.so 2>/dev/null.
2. On Windows 10 and Server 2012 to 2019 builds that shipped Flash, install KB4577586. It removes the Windows-bundled copy and cannot be uninstalled. It does not remove separately installed Flash.
3. Uninstall every standalone Flash Player. Do not reinstall a 2014 build to "patch" these CVEs.
4. If a legacy application cannot run without Flash, cut that machine off from web browsing and email, and schedule its replacement.

How to tell if you were hit#

A drive-by compromise from 2013 or 2014 leaves little to find today. On legacy hosts that still have Flash, look in EDR history for processes started by browsers or plugin hosts, such as old Firefox's plugin-container.exe. Search mail and file shares for .docx files with embedded SWF content, the lure Kaspersky documented. Treat any such machine as untrusted until it is rebuilt.

Timeline#

• Feb 26, 2013 — APSB13-08 fixes CVE-2013-0643 and CVE-2013-0648, exploited against Firefox users.
• Feb 4, 2014 — APSB14-04 fixes CVE-2014-0497. Kaspersky publishes its analysis the next day.
• Feb 20, 2014 — APSB14-07 fixes CVE-2014-0502, used in Operation GreedyWonk.
• Dec 31, 2020 — Flash Player reaches end of life.
• Jan 12, 2021 — Adobe blocks Flash content from running in Flash Player.
• Sep 17, 2024 — CISA adds all four CVEs to KEV.
• Oct 8, 2024 — Federal deadline to stop using Flash.

Vulnerability records

• CVE-2013-0643 · KEV 2024-09-17 · The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before…
• CVE-2013-0648 · KEV 2024-09-17 · Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows…
• CVE-2014-0497 · KEV 2024-09-17 · Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on…
• CVE-2014-0502 · KEV 2024-09-17 · Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Adobe — APSB13-08: Security updates available for Adobe Flash Player (archived) web.archive.org
2. Adobe — APSB14-04: Security updates available for Adobe Flash Player (archived) web.archive.org
3. Adobe — APSB14-07: Security updates available for Adobe Flash Player (archived) web.archive.org
4. Adobe — Adobe Flash Player EOL General Information (archived) web.archive.org
5. CVE record — CVE-2013-0643 cve.org
6. CVE record — CVE-2013-0648 cve.org
7. CVE record — CVE-2014-0497 cve.org
8. CVE record — CVE-2014-0502 cve.org
9. CISA — Known Exploited Vulnerabilities: CVE-2014-0502 cisa.gov
10. CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 17, 2024) cisa.gov
11. Kaspersky Securelist — CVE-2014-0497: a 0-day vulnerability securelist.com
12. Microsoft — KB4577586: Update for the removal of Adobe Flash Player support.microsoft.com
13. InfoWorld — Adobe Flash exploit targets security, public policy sites infoworld.com