Is CVE-2013-2597 being actively exploited?

Yes. CVE-2013-2597 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on September 15, 2022.

What is the CVSS score for CVE-2013-2597?

CVE-2013-2597 has a CVSS 3.1 base score of 8.4 (HIGH).

CVE-2013-2597

HIGH · CVSS 8.4CISA KEV: actively exploitedEPSS 1.5%EU EUVD: exploited

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument.

Key facts

CVSS score: 8.4 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-121
EPSS score: 1.5% (74th percentile)
In CISA KEV: Yes, added September 15, 2022
In EU EUVD: Yes (EUVD-2013-2539)
Published: August 31, 2014
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability

Added to the KEV catalog on September 15, 2022; federal remediation due October 6, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-2539 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm
codeaurora / android-msm

and 122 more…

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2597(US Government Resource)
https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597(Broken Link, Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain