Critical 9.8Known exploited (CISA KEV)Published Jun 18, 2013

CVE-2013-2465Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remo…

Updated under an hour ago (Oct 26, 2026, 3:10 PM ET)

Does this affect you?

It affects oracle jre and 5 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Mar 28, 2022; federal agencies had to remediate by Apr 18, 2022, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for oracle jre

Exploited in the last 30 days

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-693
Known exploited: Added to CISA KEV Mar 28, 2022; federal remediation due Apr 18, 2022; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 98.77% (percentile 100)
Assigned by: oracle
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

oracle jre oracle:jre	1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; 1.7.0; and 34 more ranges	NVD
sun jre sun:jre	1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; and 42 more ranges	NVD
suse linux_enterprise_desktop suse:linux_enterprise_desktop	10	NVD
suse linux_enterprise_java suse:linux_enterprise_java	10; 11; 11	NVD
suse linux_enterprise_server suse:linux_enterprise_server	10; 10; 11; 11; 11; 11	NVD
suse linux_enterprise_software_development_kit suse:linux_enterprise_software_development_kit	11; 11	NVD

References

References

http://rhn.redhat.com/errata/RHSA-2013-1060.html	vendor-advisory, x-refsource-redhat, third-party-advisory
http://marc.info/?l=bugtraq&m=137545592101387&w=2	vendor-advisory, x-refsource-hp, mailing-list, third-party-advisory
https://access.redhat.com/errata/RHSA-2014:0414	vendor-advisory, x-refsource-redhat
http://security.gentoo.org/glsa/glsa-201406-32.xml	vendor-advisory, x-refsource-gentoo, third-party-advisory
http://www.securityfocus.com/bid/60657	vdb-entry, x-refsource-bid, broken-link, third-party-advisory
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html	x-refsource-confirm, vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00031.html	vendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html	vendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
http://marc.info/?l=bugtraq&m=137545505800971&w=2	vendor-advisory, x-refsource-hp, mailing-list, third-party-advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html	vendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
1–10 of 30

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.