$ cve CVE-2013-5331 JSON

CVE-2013-5331 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 72.5% (pctl 99)

Patch early

A public exploit exists.

Description

Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified "type confusion," as exploited in the wild in December 2013.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	72.5% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2013-12-11
Last modified	2026-06-16

Affected (6)

Vendor	Product
adobe	air
adobe	air sdk
adobe	flash player
apple	mac os x
linux	linux kernel
microsoft	windows

Public exploits

Source	Title	Date
exploit-db	Adobe Flash Player - Type Confusion Remote Code Execution (Metasploit)	2014-04-29

References

→ the Explorer · watch your stack · NVD