CVE-2011-0611KEV · OVERDUE

Adobe Flash Player Remote Code Execution Vulnerability

High · published April 13, 2011

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1673
days past CISA
deadline
CVSS v3.1
8.8
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A sneaky flaw in Adobe Flash Player lets attackers tap-dance into your system! 🌩️ If you’re running outdated versions, you could be handing over the keys to the kingdom! Think of this vulnerability like a magician slipping an unexpected rabbit under the stage. While the audience is distracted, that rabbit could easily cause chaos in the audience by triggering surprises no one is prepared for. In this case, the crafted Flash content is the magician’s trick that can manipulate your system without you even knowing it. An attacker could exploit this vulnerability to run arbitrary code on your machine, potentially leading to full system compromise or a crash that stops your applications in their tracks. In the wild, this means they could access sensitive data or even take control of your system completely – absolutely devastating!

Put simply

Think of this vulnerability like a magician slipping an unexpected rabbit under the stage. While the audience is distracted, that rabbit could easily cause chaos in the audience by triggering surprises no one is prepared for. In this case, the crafted Flash content is the magician’s trick that can manipulate your system without you even knowing it. This vulnerability is due to an inconsistency in size and type handling in Adobe Flash content, allowing attackers to confuse the application and execute arbitrary code or cause a denial of service. It affects versions of Adobe Flash Player before 10.2.154.27 on various platforms, including Windows and Mac OS X.

What to do

An attacker could exploit this vulnerability to run arbitrary code on your machine, potentially leading to full system compromise or a crash that stops your applications in their tracks. In the wild, this means they could access sensitive data or even take control of your system completely – absolutely devastating! Immediately update Adobe Flash Player to version 10.2.154.27 or later if you're still using it, and ensure your Adobe AIR and Reader versions are up to date as well. Additionally, review any Microsoft Office documents that may contain embedded Flash content and avoid opening suspicious files. You've got this! Follow these steps, and you'll be one step closer to securing your system against this vulnerability! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99410 · 99.9th percentile
Published
2011-04-13T14:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 13 APR 14:00Z
    Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and…
    cvelistv5