CVE-2014-0502KEV · OVERDUE

Adobe Flash Player Double Free Vulnerablity

High · published February 21, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.9th percentile for exploit probability.

744
days past CISA
deadline
CVSS v3.1
8.8
EPSS
25%
Percentile
97.9
In the wild
Confirmed
What it is

🚨 A double free vulnerability in Adobe Flash Player can lead to remote code execution, making it a playground for attackers! 🔥 Think of this like a restaurant that mistakenly allows two different customers to claim the last slice of pizza simultaneously — if both get their hands on it, chaos ensues! 🍕 In cyber terms, it means the attacker can run any code they desire, effectively taking control of your system. If exploited, attackers can execute arbitrary code, giving them complete control over the affected machines. This could mean accessing sensitive information, installing malicious software, or even launching further attacks on your network. The consequences could be absolutely devastating!

Put simply

Think of this like a restaurant that mistakenly allows two different customers to claim the last slice of pizza simultaneously — if both get their hands on it, chaos ensues! 🍕 In cyber terms, it means the attacker can run any code they desire, effectively taking control of your system. This vulnerability arises when Flash Player improperly handles memory allocation, allowing attackers to free the same memory block twice. This mishandling can lead to memory corruption and, ultimately, remote code execution.

What to do

If exploited, attackers can execute arbitrary code, giving them complete control over the affected machines. This could mean accessing sensitive information, installing malicious software, or even launching further attacks on your network. The consequences could be absolutely devastating! Make sure to update your Adobe Flash Player to version 11.7.700.269 or later, or 12.0.0.70 or later for Mac OS X users. Don't forget to also check any Adobe AIR components and update them to at least version 4.0.0.1628. Always keep your software up to date to mitigate risks! You've got this! Stay vigilant and proactive, and you'll keep your systems safe from threats! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.24817 · 97.9th percentile
Published
2014-02-21T02:00Z
KEV added
2024-09-17 · due 2024-10-08
EPSS history
Timeline
  • 17 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 8
    kev
  • 21 FEB 02:00Z
    Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341…
    cvelistv5