CVE-2012-2034KEV · OVERDUE

Adobe Flash Player Memory Corruption Vulnerability

High · published June 9, 2012

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 94.6th percentile for exploit probability.

1648
days past CISA
deadline
CVSS v3.1
7.5
EPSS
8%
Percentile
94.6
In the wild
Confirmed
What it is

🚨 Adobe Flash Player has a nasty flaw that lets attackers run any code they want! 🔥 Think of it as a theater production where the stage crew accidentally leaves the door open for someone to walk in and change the script mid-show. Without proper checks, an attacker can jump in and perform their own act, wreaking havoc on your system! This vulnerability could allow a malicious actor to execute arbitrary code on your system, potentially leading to total compromise of your machine or causing it to crash in a spectacular failure. Imagine your favorite application going belly-up because it got hijacked!

Put simply

Think of it as a theater production where the stage crew accidentally leaves the door open for someone to walk in and change the script mid-show. Without proper checks, an attacker can jump in and perform their own act, wreaking havoc on your system! This vulnerability exists in Adobe Flash Player and Adobe AIR due to memory corruption issues that arise from unspecified vectors, allowing an attacker to manipulate the application's execution flow.

What to do

This vulnerability could allow a malicious actor to execute arbitrary code on your system, potentially leading to total compromise of your machine or causing it to crash in a spectacular failure. Imagine your favorite application going belly-up because it got hijacked! To safeguard your environment, immediately update your Adobe Flash Player to version 10.3.183.20 or newer, and for Adobe AIR, ensure you're on version 3.3.0.3610 or later. Regularly check for security patches and consider disabling Flash entirely if it's not critical for your operations. You've got this! With these updates, you're not just patching vulnerabilities; you're becoming a security hero! 🦸‍♂️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07713 · 94.6th percentile
Published
2012-06-09T00:00Z
KEV added
2022-03-28 · due 2022-04-18
EPSS history
Timeline
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev
  • 09 JUN 00:00Z
    Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before…
    cvelistv5