Loading vulnerability…
CVE-2013-0634 is a memory corruption vulnerability in Adobe Flash Player affecting multiple platforms and versions: Windows and Mac OS X before 10.3.183.51 and 11.x before 11.5.502.149; Linux before 10.3.183.51 and 11.x before 11.2.202.262; Android 2.x/3.x before 11.1.111.32; and Android 4.x before 11.1.115.37. The issue is triggered by crafted SWF content and can lead to arbitrary code execution or denial of service. The provided content does not identify the exact vulnerable function, but it consistently characterizes the flaw as memory corruption in Flash parsing/rendering of malicious SWF data. The vulnerability was exploited in the wild in February 2013 and was subsequently integrated into multiple exploit kits including DotkaChef, Angler FlashPack, Magnitude, Grandsoft, Topic EK, RIG, HiMan, and CottonCastle.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (adobe_flash_regex_value.rb) that exploits a heap overflow vulnerability (CVE-2013-0634) in Adobe Flash Player versions prior to 11.5.502.149 on Windows. The exploit targets users browsing with Internet Explorer and the vulnerable Flash ActiveX control. The module sets up a browser exploit server that delivers a crafted HTML page and a malicious SWF file to the victim. The SWF file triggers the vulnerability, allowing the attacker to execute arbitrary code (customizable via Metasploit payloads) in the context of the user. The module references several public advisories and blog posts, and is fully integrated into the Metasploit framework, allowing for payload customization and automated exploitation. The only network endpoint hardcoded is the official Macromedia Flash ActiveX codebase URL, and the exploit relies on serving a local SWF file from the Metasploit data directory.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A 2013 vulnerability widely used by exploit kits, reflecting broad criminal exploitation.
A specific Adobe Flash vulnerability included in the RIG exploit pack.
A specifically referenced Flash vulnerability mentioned only to clarify it was not the Flash exploit being used in the discussed Magnitude exploit kit activity.
An Adobe Flash Player vulnerability noted as being incorporated into the HiMan exploit kit.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.