What is the CVSS score of CVE-2013-2465?

CVE-2013-2465 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 93.2%.

Which versions of Java Runtime Environment are affected by CVE-2013-2465?

CVE-2013-2465 is a critical Java Runtime Environment sandbox bypass affecting millions of organizations running vulnerable JRE versions (5.0-7.x).. A patch is available.

Is there a public PoC exploit available for CVE-2013-2465?

Yes, a public proof-of-concept exploit is available for CVE-2013-2465. Prioritise patching immediately. EPSS: 93.2%.

How to fix or mitigate CVE-2013-2465?

Within 24 hours: Identify and inventory all systems running Oracle JRE 5.0 through Update 45, JRE 6 through Update 45, JRE 7 through Update 21, or OpenJDK 7 using SCCM, Qualys, or equivalent asset management tools. Within 7 days: Apply Oracle's June 2013 CPU security patches to all affected JRE installations (JRE 7 Update 25 or later, JRE 6 Update 45 or later, JRE 5.0 with latest critical patches). Consider disabling Java browser plugins enterprise-wide if immediate patching is not feasible. Within 30 days: Enforce Java version policies preventing installation of EOL JRE versions and establish quarterly patch management cycles for all Java environments.

Java Runtime Environment CVE-2013-2465

CRITICAL

Protection Mechanism Failure (CWE-693)

2013-06-18 secalert_us@oracle.com

Java Oracle Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 22, 2026 - 13:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Oct 22, 2025 - 01:15 cisa

CISA KEV

PoC Detected

Oct 22, 2025 - 01:15 vuln.today

Public exploit code

Patch released

Oct 22, 2025 - 01:15 nvd

Patch available

CVE Published

Jun 18, 2013 - 22:55 nvd

CRITICAL 9.8

DescriptionCVE.org

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

AnalysisAI

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.

Technical ContextAI

This vulnerability resides in the Java 2D graphics rendering component, which handles image processing, drawing, and rendering operations across the Java platform. The root cause (CWE-693) indicates a protection mechanism failure where the Java 2D component incorrectly verifies image channels during processing. The Java sandbox security model relies on multiple verification layers to isolate untrusted code execution; failures in component-level input validation can compromise the entire sandbox. The 2D component processes image data from multiple sources including network streams, making incorrect channel verification a critical trust boundary failure. CPE data confirms impact across three major JRE version families (5.0, 6, 7) and the open-source OpenJDK 7 implementation, indicating a deep architectural flaw rather than version-specific regression.

RemediationAI

Immediately upgrade Oracle JRE to version 7 Update 25, 6 Update 51, or 5.0 Update 51 released in Oracle's June 2013 Critical Patch Update. For OpenJDK 7 users, apply the upstream fix available at http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040 or update to distribution-provided patched packages per RHSA-2013-0963, RHSA-2013-1059, RHSA-2013-1060, and corresponding SUSE/openSUSE security advisories from July-August 2013. For environments unable to immediately patch, implement network-layer controls blocking untrusted Java applet execution via browser plugin disablement (set deployment.security.level=VERY_HIGH and disable plugin in browser preferences), though this mitigation is incomplete as local Java applications can still be exploited via malicious JAR files or network-delivered content. Web application firewalls can block known exploit payloads targeting 2D image processing, but signature-based detection is easily evaded. Given confirmed active exploitation and public exploit availability, temporary complete Java plugin disablement is recommended until patching is verified, accepting the operational impact of broken Java-dependent web applications.

More from same product – last 7 days

CVE-2026-28575 CRITICAL Act Now

10.0 Jun 17

Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.tran

CVE-2026-41699 CRITICAL Act Now

9.8 Jun 11

Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at

CVE-2026-47835 HIGH This Week

8.6 Jun 15

NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers t

CVE-2026-47825 HIGH This Week

8.6 Jun 15

Origin validation failure in Spring Cloud Gateway (WebMVC and WebFlux Server variants) allows remote attackers to spoof

CVE-2026-40999 HIGH This Week

8.6 Jun 11

Server-Side Request Forgery in Spring Web Services (versions 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1) al

CVE-2013-2465 vulnerability details – vuln.today

Back

Java Runtime Environment CVE-2013-2465

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More from same product – last 7 days

Share

External POC / Exploit Code