Is CVE-2013-0648 being actively exploited?

Yes. CVE-2013-0648 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on September 17, 2024.

What is the CVSS score for CVE-2013-0648?

CVE-2013-0648 has a CVSS 3.1 base score of 8.8 (HIGH).

CVE-2013-0648

HIGH · CVSS 8.8CISA KEV: actively exploitedEPSS 11.1%EU EUVD: exploited

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Key facts

CVSS score: 8.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS score: 11.1% (96th percentile)
In CISA KEV: Yes, added September 17, 2024
In EU EUVD: Yes (EUVD-2013-0659)
Published: February 27, 2013
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Adobe Flash Player Code Execution Vulnerability

Added to the KEV catalog on September 17, 2024; federal remediation due October 8, 2024.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-0659 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on January 12, 2026.

View on the EU Vulnerability Database

Affected products

adobe / flash player
apple / mac os x
linux / linux kernel
microsoft / windows
opensuse / opensuse
opensuse / opensuse
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux workstation
suse / linux enterprise desktop
suse / linux enterprise desktop

References

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html(Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html(Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html(Mailing List)
http://rhn.redhat.com/errata/RHSA-2013-0574.html(Third Party Advisory)
http://www.adobe.com/support/security/bulletins/apsb13-08.html(Broken Link, Patch, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0648(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain