---
id: "CVE-2013-0648"
kind: "vulnerability"
aliases: ["CVE-2013-0648"]
title: "Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "adobe flash player", "fixed": ["10.3.183.67"], "affected": "< 10.3.183.67", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": ["11.6.602.171"], "affected": ">= 11.0, < 11.6.602.171", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": ["11.2.202.273"], "affected": ">= 11.0, < 11.2.202.273", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.4", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 12.1", "ecosystem": "vendor"}, {"name": "suse linux enterprise desktop", "fixed": [], "affected": "= 10", "ecosystem": "vendor"}, {"name": "suse linux enterprise desktop", "fixed": [], "affected": "= 11", "ecosystem": "vendor"}, {"name": "redhat enterprise linux desktop", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 5.9", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 6.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 5.9", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 6.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux workstation", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "Adobe Flash Player", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-flash-player", "browsers", "exploited", "macos", "other", "windows"]
not_affected_if: ["flash-not-installed"]
published_at: "2013-02-27T00:55:01+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0648", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before…

Adobe Flash Player has an unspecified flaw in its ExternalInterface ActionScript functionality. A remote attacker can run arbitrary code by serving crafted SWF content to a victim.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:adobe flash player affected < 10.3.183.67 fixed 10.3.183.67
- vendor:adobe flash player affected >= 11.0, < 11.6.602.171 fixed 11.6.602.171
- vendor:adobe flash player affected >= 11.0, < 11.2.202.273 fixed 11.2.202.273
- vendor:opensuse affected = 11.4 fixed ?
- vendor:opensuse affected = 12.1 fixed ?
- vendor:suse linux enterprise desktop affected = 10 fixed ?
- vendor:suse linux enterprise desktop affected = 11 fixed ?
- vendor:redhat enterprise linux desktop affected = 6.0 fixed ?
- vendor:redhat enterprise linux eus affected = 5.9 fixed ?
- vendor:redhat enterprise linux eus affected = 6.4 fixed ?
- vendor:redhat enterprise linux server affected = 6.0 fixed ?
- vendor:redhat enterprise linux server aus affected = 5.9 fixed ?
- vendor:redhat enterprise linux server aus affected = 6.4 fixed ?
- vendor:redhat enterprise linux workstation affected = 6.0 fixed ?
- vendor:Adobe Flash Player affected ? fixed ?

## How to check

Check whether any machine has Adobe Flash Player installed, for example via Add/Remove Programs or the Flash Player install directory; unknown for other commands.

## Fix

Remove Adobe Flash Player, since the product is end-of-life and CISA says users should discontinue use.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-0648

## From the sources

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_