---
title: "Adobe Flash Player: Four 2013-2014 Zero-Days Added to KEV"
url: https://erroneo.us/security/briefs/adobe-flash-player-2013-2014-zero-days-eol-kev/
description: "Four Flash Player bugs exploited as zero-days in 2013-2014 joined CISA KEV in September 2024. Flash is end of life; find and remove any copy left."
type: security-brief
section: "Security Digest"
date_published: 2013-02-26
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2013-0643", "CVE-2013-0648", "CVE-2014-0497", "CVE-2014-0502"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Adobe Flash Player: Four 2013-2014 Zero-Days Added to KEV

**Verdict: Most can relax.** These are 2013-2014 zero-days in a plugin Adobe stopped supporting in 2020 and modern browsers no longer load; the only job left is to find and remove any Flash Player still installed on legacy machines.

- **Who must act:** Owners of legacy Windows, macOS or Linux machines, kiosks, lab images or industrial workstations that still have Flash Player installed and a browser or application that loads it.
- **Who can relax:** Anyone on a current browser with Flash Player already uninstalled; no supported browser runs Flash content, and every Flash build since February 2014 already contains these fixes.
- **Affected:** CVE-2013-0643, CVE-2013-0648: Flash Player 11.6.602.168 and earlier (Windows), 11.6.602.167 and earlier (Mac), 11.2.202.270 and earlier (Linux); CVE-2014-0497: Flash Player 12.0.0.43 and earlier (Windows, Mac), 11.2.202.335 and earlier (Linux); CVE-2014-0502: Flash Player 12.0.0.44 and earlier (Windows, Mac), 11.2.202.336 and earlier (Linux); Adobe AIR 4.0.0.1390 and earlier; All Flash Player versions are end of life since December 31, 2020
- **Fixed:** Flash Player 11.6.602.171 / Linux 11.2.202.273 (APSB13-08, Feb 26, 2013); Flash Player 12.0.0.44 / Linux 11.2.202.336 (APSB14-04, Feb 4, 2014); Flash Player 12.0.0.70 / Linux 11.2.202.341, Adobe AIR 4.0.0.1628 (APSB14-07, Feb 20, 2014); No supported version exists; Adobe recommends uninstalling Flash Player
- **CVEs:** CVE-2013-0643, CVE-2013-0648, CVE-2014-0497, CVE-2014-0502
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory endpoints and golden images for any installed Flash Player, including standalone copies and plugins bundled with old browsers.
2. On Windows 10 and Windows Server 2012-2019 builds that shipped Flash, install KB4577586 to remove the Windows-bundled copy.
3. Uninstall every remaining standalone Flash Player; do not reinstall old builds to patch these CVEs.
4. If a legacy application truly cannot run without Flash, isolate that machine from web browsing and email and plan its replacement.
5. Block .swf downloads and Flash MIME types at web proxies where they serve no business purpose.

### How to check if you are affected

- Check for Flash binaries: C:\Windows\System32\Macromed\Flash and SysWOW64\Macromed\Flash on Windows, /Library/Internet Plug-Ins/Flash Player.plugin on macOS, libflashplayer.so on Linux.
- Search EDR history on legacy hosts for processes spawned by browsers or plugin hosts such as Firefox's plugin-container.exe.
- Search mail and file stores for .docx files with embedded SWF content, the delivery method Kaspersky documented for CVE-2014-0497.

## What happened

Between February 2013 and February 2014, Adobe shipped three emergency Flash Player bulletins for four bugs that attackers were already using.

- [APSB13-08](https://web.archive.org/web/20131115041120/http://www.adobe.com/support/security/bulletins/apsb13-08.html) (Feb 26, 2013) fixed [CVE-2013-0643](https://www.cve.org/CVERecord?id=CVE-2013-0643), a permissions flaw in Flash's Firefox sandbox, and [CVE-2013-0648](https://www.cve.org/CVERecord?id=CVE-2013-0648), a bug in the ExternalInterface ActionScript feature. Adobe said both were exploited "in targeted attacks" that lured users to a site serving malicious SWF content, and that the exploit was built to target Firefox.
- [APSB14-04](https://web.archive.org/web/20150111010843/http://helpx.adobe.com/security/products/flash-player/apsb14-04.html) (Feb 4, 2014) fixed [CVE-2014-0497](https://www.cve.org/CVERecord?id=CVE-2014-0497), an integer underflow reported by Kaspersky. [Kaspersky found 11 exploits](https://securelist.com/cve-2014-0497-a-0-day-vulnerability/58244/) embedded in .docx files with Korean-language names. The victims appeared to be in China, and one payload included a spy tool that stole mailbox passwords.
- [APSB14-07](https://web.archive.org/web/20150111003028/http://helpx.adobe.com/security/products/flash-player/apsb14-07.html) (Feb 20, 2014) fixed [CVE-2014-0502](https://www.cve.org/CVERecord?id=CVE-2014-0502), a double free credited to the Google Security Team and FireEye. FireEye called the campaign Operation GreedyWonk. According to [InfoWorld](https://www.infoworld.com/article/2193443/adobe-flash-exploit-targets-security-public-policy-sites-2.html), three nonprofit policy sites redirected visitors through a hidden iframe to the exploit server. FireEye said the attackers "appear to be Chinese speakers."

On September 17, 2024, CISA [added all four](https://www.cisa.gov/news-events/alerts/2024/09/17/cisa-adds-four-known-exploited-vulnerabilities-catalog) to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0502) "based on evidence of active exploitation," with an October 8, 2024 deadline. Because the product is end of life, the required action is to stop using it. NVD and CISA score each bug CVSS 3.1 8.8.

## Who is affected

Only Flash builds from before each fix: before 11.6.602.171 on Windows and Mac for the 2013 pair, before 12.0.0.44 for CVE-2014-0497, and before 12.0.0.70 for CVE-2014-0502. Linux and Adobe AIR had their own fixed builds, listed above. The [Adobe EOL page](https://web.archive.org/web/20250101011125/https://www.adobe.com/products/flashplayer/end-of-life-alternative.html) says Adobe stopped supporting Flash Player after December 31, 2020, and "blocked Flash content from running in Flash Player beginning January 12, 2021." It "strongly recommends all users immediately uninstall Flash Player."

## Do you really need to act?

Almost certainly not. CISA did not explain why it listed these bugs in 2024. We found no report of a new campaign using them as of October 23, 2026. The only documented exploitation is the zero-day use in 2013 and 2014. A successful attack today needs a 2013 or early-2014 Flash build, plus a browser that still loads plugins. Current browsers do not.

The real exposure is legacy machines: frozen VM images, kiosks, lab PCs or industrial workstations with an old browser and Flash still installed. On those machines the problem is bigger than these four CVEs. Flash has had no security updates since 2020, so any copy should go.

## What to do now

1. Inventory. On Windows, check `dir C:\Windows\System32\Macromed\Flash C:\Windows\SysWOW64\Macromed\Flash`. On macOS, run `ls "/Library/Internet Plug-Ins/" | grep -i flash`. On Linux, run `find / -name libflashplayer.so 2>/dev/null`.
2. On Windows 10 and Server 2012 to 2019 builds that shipped Flash, install [KB4577586](https://support.microsoft.com/en-us/servicing/os/windows/2020/10/kb4577586-update-for-the-removal-of-adobe-flash-player-october-27-2020). It removes the Windows-bundled copy and cannot be uninstalled. It does not remove separately installed Flash.
3. Uninstall every standalone Flash Player. Do not reinstall a 2014 build to "patch" these CVEs.
4. If a legacy application cannot run without Flash, cut that machine off from web browsing and email, and schedule its replacement.

## How to tell if you were hit

A drive-by compromise from 2013 or 2014 leaves little to find today. On legacy hosts that still have Flash, look in EDR history for processes started by browsers or plugin hosts, such as old Firefox's `plugin-container.exe`. Search mail and file shares for .docx files with embedded SWF content, the lure Kaspersky documented. Treat any such machine as untrusted until it is rebuilt.

## Timeline

- Feb 26, 2013 — APSB13-08 fixes CVE-2013-0643 and CVE-2013-0648, exploited against Firefox users.
- Feb 4, 2014 — APSB14-04 fixes CVE-2014-0497. Kaspersky publishes its analysis the next day.
- Feb 20, 2014 — APSB14-07 fixes CVE-2014-0502, used in Operation GreedyWonk.
- Dec 31, 2020 — Flash Player reaches end of life.
- Jan 12, 2021 — Adobe blocks Flash content from running in Flash Player.
- Sep 17, 2024 — CISA adds all four CVEs to KEV.
- Oct 8, 2024 — Federal deadline to stop using Flash.

## Sources

1. [Adobe — APSB13-08: Security updates available for Adobe Flash Player (archived)](https://web.archive.org/web/20131115041120/http://www.adobe.com/support/security/bulletins/apsb13-08.html)
2. [Adobe — APSB14-04: Security updates available for Adobe Flash Player (archived)](https://web.archive.org/web/20150111010843/http://helpx.adobe.com/security/products/flash-player/apsb14-04.html)
3. [Adobe — APSB14-07: Security updates available for Adobe Flash Player (archived)](https://web.archive.org/web/20150111003028/http://helpx.adobe.com/security/products/flash-player/apsb14-07.html)
4. [Adobe — Adobe Flash Player EOL General Information (archived)](https://web.archive.org/web/20250101011125/https://www.adobe.com/products/flashplayer/end-of-life-alternative.html)
5. [CVE record — CVE-2013-0643](https://www.cve.org/CVERecord?id=CVE-2013-0643)
6. [CVE record — CVE-2013-0648](https://www.cve.org/CVERecord?id=CVE-2013-0648)
7. [CVE record — CVE-2014-0497](https://www.cve.org/CVERecord?id=CVE-2014-0497)
8. [CVE record — CVE-2014-0502](https://www.cve.org/CVERecord?id=CVE-2014-0502)
9. [CISA — Known Exploited Vulnerabilities: CVE-2014-0502](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0502)
10. [CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 17, 2024)](https://www.cisa.gov/news-events/alerts/2024/09/17/cisa-adds-four-known-exploited-vulnerabilities-catalog)
11. [Kaspersky Securelist — CVE-2014-0497: a 0-day vulnerability](https://securelist.com/cve-2014-0497-a-0-day-vulnerability/58244/)
12. [Microsoft — KB4577586: Update for the removal of Adobe Flash Player](https://support.microsoft.com/en-us/servicing/os/windows/2020/10/kb4577586-update-for-the-removal-of-adobe-flash-player-october-27-2020)
13. [InfoWorld — Adobe Flash exploit targets security, public policy sites](https://www.infoworld.com/article/2193443/adobe-flash-exploit-targets-security-public-policy-sites-2.html)

---
Source page: https://erroneo.us/security/briefs/adobe-flash-player-2013-2014-zero-days-eol-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt