CVE-2013-1488

CVE-2013-1488 is a critical-severity vulnerability in Oracle Jdk with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 87% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-94.

Key facts

• Severity: Critical (CVSS 2.0 base score 10.0)
• EPSS exploit prediction: 87% (100th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-94
• Affected product: Oracle Jdk
• Published: 2013-03-08
• Last modified: 2026-06-16

Description

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

Frequently asked questions

What is CVE-2013-1488?

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

How severe is CVE-2013-1488?

CVE-2013-1488 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2013-1488 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 87% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-1488?

CVE-2013-1488 primarily affects Oracle Jdk. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2013-1488?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2013-1488 published?

CVE-2013-1488 was published on 2013-03-08 and last updated on 2026-06-16.

References

• http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/
• http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/
• http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
• http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/a19614a3dabb
• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00007.html
• http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html
• http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-April/022796.html
• http://rhn.redhat.com/errata/RHSA-2013-0752.html
• http://rhn.redhat.com/errata/RHSA-2013-0757.html
• http://security.gentoo.org/glsa/glsa-201406-32.xml
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:145
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:161
• http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
• http://www.ubuntu.com/usn/USN-1806-1
• http://www.us-cert.gov/ncas/alerts/TA13-107A
• http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/
• https://bugzilla.redhat.com/show_bug.cgi?id=920247
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16511
• https://twitter.com/thezdi/status/309425888188043264
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130

Affected products (2)

• cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*
• cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*

More vulnerabilities in Oracle Jdk

• CVE-2016-0494 — Critical (CVSS 10.0): Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and…
• CVE-2016-0483 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows…
• CVE-2015-4883 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers…
• CVE-2015-4881 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers…
• CVE-2015-4860 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers…
• CVE-2015-4844 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers…

All CVEs affecting Oracle Jdk →

Other CWE-94 (Code Injection) vulnerabilities

• CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
• CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
• CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
• CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
• CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
• CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →