CVE-2014-8439KEV · OVERDUE

Adobe Flash Player Dereferenced Pointer Vulnerability

High · published November 25, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.5th percentile for exploit probability.

1591
days past CISA
deadline
CVSS v3.1
8.8
EPSS
20%
Percentile
97.5
In the wild
Confirmed
What it is

🚨 A simple flaw in Adobe Flash Player could allow attackers to execute arbitrary code or even crash your app! 🔥 Think of this vulnerability like a waiter who blindly serves a dish without checking the order — if the order's wrong, it could lead to a major mess right in the kitchen! 🍽️ An attacker could exploit this flaw to run malicious code on your system, which could lead to anything from stealing your data to completely compromising your machine. Even worse, it could simply crash applications using Adobe AIR, leaving your users in the lurch! 😱

Put simply

Think of this vulnerability like a waiter who blindly serves a dish without checking the order — if the order's wrong, it could lead to a major mess right in the kitchen! 🍽️ This vulnerability stems from an invalid pointer dereference in Adobe Flash Player and AIR, allowing attackers to manipulate memory and execute arbitrary code without proper authorization.

What to do

An attacker could exploit this flaw to run malicious code on your system, which could lead to anything from stealing your data to completely compromising your machine. Even worse, it could simply crash applications using Adobe AIR, leaving your users in the lurch! 😱 To safeguard your systems, update Adobe Flash Player to version 13.0.0.258 or later, and Adobe AIR to at least version 15.0.0.293. It's crucial to also audit your systems to ensure they are not running outdated versions. 🛡️ You've got this! Following these steps will help you lock down your systems and keep those attackers at bay! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.20369 · 97.5th percentile
Published
2014-11-25T23:00Z
KEV added
2022-05-25 · due 2022-06-15
EPSS history
Timeline
  • 25 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 15
    kev
  • 25 NOV 23:00Z
    Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293…
    cvelistv5