Is CVE-2013-0643 being actively exploited?

Yes. CVE-2013-0643 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on September 17, 2024.

What is the CVSS score for CVE-2013-0643?

CVE-2013-0643 has a CVSS 3.1 base score of 8.8 (HIGH).

CVE-2013-0643

HIGH · CVSS 8.8CISA KEV: actively exploitedEPSS 10.5%EU EUVD: exploited

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Key facts

CVSS score: 8.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-269
EPSS score: 10.5% (96th percentile)
In CISA KEV: Yes, added September 17, 2024
In EU EUVD: Yes (EUVD-2013-0654)
Published: February 27, 2013
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Adobe Flash Player Incorrect Default Permissions Vulnerability

Added to the KEV catalog on September 17, 2024; federal remediation due October 8, 2024.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-0654 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

adobe / flash player
apple / mac os x
linux / linux kernel
microsoft / windows
opensuse / opensuse
opensuse / opensuse
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux workstation
suse / linux enterprise desktop
suse / linux enterprise desktop

References

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html(Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html(Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html(Mailing List)
http://rhn.redhat.com/errata/RHSA-2013-0574.html(Third Party Advisory)
http://www.adobe.com/support/security/bulletins/apsb13-08.html(Broken Link, Patch, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0643(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain