CVE-2013-0643: Adobe Flash Player

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run Adobe Flash Player. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2024-09-17, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2024-10-08; treat that as the outer limit, not the target.
EPSS 10.5%, percentile 96: FIRST’s model estimates a 10.5% chance of exploitation activity in the next 30 days, higher than 96% of all scored CVEs (very high). EPSS is a probability, not a verdict.
Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.

What it is

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

CISA’s summary

Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.

Weakness type: CWE-269, CWE-264.

Product: Adobe Flash Player · Assigned by: adobe · Published: 2013-02-27

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
n/a	n/a	see vendor advisory

Severity scores

Scored by	CVSS	Score	Vector
CISA-ADP	3.1	8.8 High	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Attack vector: network (remotely reachable)
Attack complexity: low
Privileges required: none (no login)
User interaction: required (a user must click/open something)
Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2024-09-17; federal due date 2024-10-08. Known ransomware use: Unknown.
CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA SSVC assessment: exploitation active, automatable no, technical impact total.
FIRST EPSS (model of 2026-10-21): 10.53% probability of exploitation activity in the next 30 days; percentile 96.

Timeline

2013-02-27 — CVE record published by adobe
2024-09-17 — Added to CISA’s Known Exploited Vulnerabilities catalog
2024-10-08 — CISA remediation deadline for US federal agencies
2025-10-22 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Other references from the CVE record and advisory

adobe.com adobe.com

All exploited Adobe vulnerabilities · Today’s Security Digest