Java Runtime Environment
CVE-2013-2465
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconHost malicious webpage
-
DeliveryVictim browses to exploit site
-
ExploitJava plugin loads crafted applet
-
InstallTrigger 2D image channel verification flaw
-
C2Escape Java sandbox
-
ExecuteExecute arbitrary code with user privileges
-
ImpactEstablish persistence or lateral movement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2021 - Security Misconfiguration
ASVS 5.0
V14 - Configuration Security hardening, default configuration review
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle JRE 5.0-7u21 and OpenJDK 7 with Java browser plugin enabled. Standard Java installations with default security settings are vulnerable. Exploitation requires only that the target system has a vulnerable Java version installed and the browser plugin enabled, which was the default deployment mode for consumer and enterprise Java installations through 2013. User interaction limited to browsing to attacker-controlled or compromised website. Attack succeeds against all platforms (Windows, Linux, macOS) equally. No special Java security policy configurations, non-default features, or elevated privileges required for successful sandbox escape. |
| Impact | This represents critical real-world risk with exceptional threat convergence across all assessment frameworks. CVSS 9.8 indicates maximum exploitability (network vector, low complexity, no authentication, no user interaction) with complete confidentiality, integrity, and availability impact. EPSS 93.22% at 100th percentile confirms this vulnerability among the most actively exploited ever recorded. CISA KEV listing provides government-confirmed evidence of in-the-wild exploitation campaigns. Public exploit availability lowers the skill threshold for exploitation. SSVC decision tree yields immediate action required: confirmed exploitation status, network automatable delivery, total technical impact including sandbox escape. The only limiting factor is Java deployment prevalence in the target environment. Unlike many high-CVSS theoretical vulnerabilities, every available signal - CVSS, EPSS, KEV, POC - aligns to confirm this as an apex-tier threat requiring emergency response. Organizations running affected Java versions face imminent compromise risk from commodity and advanced threat actors alike. |
| Exploit ScenarioDerived | Attacker hosts malicious web page containing specially crafted Java applet with manipulated 2D image channel data. Victim browses to attacker-controlled site or legitimate compromised website serving the exploit. Java plugin automatically processes the malicious applet, triggering incorrect image channel verification in the 2D component, allowing attacker code to escape the Java sandbox and execute arbitrary commands with the user's privileges on the underlying operating system. No user interaction beyond visiting the page is required for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 22, 2026
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.
Earlier versions of this analysis (1)
An unspecified vulnerability in the Java Runtime Environment's 2D graphics subsystem allows untrusted Java applets and Web Start applications to bypass the security sandbox for complete system compromise.
RemediationAI
Immediately upgrade Oracle JRE to version 7 Update 25, 6 Update 51, or 5.0 Update 51 released in Oracle's June 2013 Critical Patch Update. For OpenJDK 7 users, apply the upstream fix available at http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040 or update to distribution-provided patched packages per RHSA-2013-0963, RHSA-2013-1059, RHSA-2013-1060, and corresponding SUSE/openSUSE security advisories from July-August 2013. For environments unable to immediately patch, implement network-layer controls blocking untrusted Java applet execution via browser plugin disablement (set deployment.security.level=VERY_HIGH and disable plugin in browser preferences), though this mitigation is incomplete as local Java applications can still be exploited via malicious JAR files or network-delivered content. Web application firewalls can block known exploit payloads targeting 2D image processing, but signature-based detection is easily evaded. Given confirmed active exploitation and public exploit availability, temporary complete Java plugin disablement is recommended until patching is verified, accepting the operational impact of broken Java-dependent web applications.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability resides in the Java 2D graphics rendering component, which handles image processing, drawing, and rendering operations across the Java platform. The root cause (CWE-693) indicates a protection mechanism failure where the Java 2D component incorrectly verifies image channels during processing. The Java sandbox security model relies on multiple verification layers to isolate untrusted code execution; failures in component-level input validation can compromise the entire sandbox. The 2D component processes image data from multiple sources including network streams, making incorrect channel verification a critical trust boundary failure. CPE data confirms impact across three major JRE version families (5.0, 6, 7) and the open-source OpenJDK 7 implementation, indicating a deep architectural flaw rather than version-specific regression.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
Executive ViewAI
CVE-2013-2465 is a critical Java Runtime Environment sandbox bypass affecting millions of organizations running vulnerable JRE versions (5.0-7.x). Remote attackers can execute arbitrary code without authentication, completely bypassing Java security restrictions. This vulnerability has confirmed active exploitation in the wild and poses immediate risk to any system running unpatched Java, particularly web browsers with Java plugins and Java-based applications.
Apply vendor patch. If patching is delayed: disable Java browser plugins in all web browsers via group policy; isolate Java-dependent applications to segmented networks with restricted internet access; implement application whitelisting to prevent unauthorized code execution; require multi-factor authentication for systems running Java applications; monitor for exploitation attempts via endpoint detection and response (EDR) tools.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property
GitHub PoC