CVE-2014-9163KEV · OVERDUE

Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

High · published December 10, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.5th percentile for exploit probability.

1633
days past CISA
deadline
CVSS v3.1
7.8
EPSS
21%
Percentile
97.5
In the wild
Confirmed
What it is

🚨 A classic stack-based buffer overflow in Adobe Flash Player can let attackers run arbitrary code on your system, and it's been exploited in the wild! 🔥 Think of this vulnerability like a crowded restaurant where too many people are trying to squeeze into a single small booth — once it overflows, chaos ensues and anyone can take over the entire space! This flaw allows attackers to execute arbitrary code, potentially giving them full control over your computer. Imagine a cyber intruder pulling all the strings, accessing your files, and wreaking havoc without you even knowing it! It’s absolutely devastating if the vulnerability is left unpatched, especially since it has been actively exploited since December 2014.

Put simply

Think of this vulnerability like a crowded restaurant where too many people are trying to squeeze into a single small booth — once it overflows, chaos ensues and anyone can take over the entire space! The vulnerability allows exploitation by overflowing the stack memory, enabling an attacker to execute malicious code by sending crafted data through unspecified vectors, which can compromise the host's security.

What to do

This flaw allows attackers to execute arbitrary code, potentially giving them full control over your computer. Imagine a cyber intruder pulling all the strings, accessing your files, and wreaking havoc without you even knowing it! It’s absolutely devastating if the vulnerability is left unpatched, especially since it has been actively exploited since December 2014. To protect yourself, immediately update Adobe Flash Player to version 13.0.0.259 or later on Windows and OS X, and to 11.2.202.425 or later on Linux. Regularly check for updates and consider disabling Flash Player altogether if it's not necessary for your work. You've got this! Follow these steps, and you’ll be on your way to securing your system like a pro! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.20724 · 97.5th percentile
Published
2014-12-10T21:00Z
KEV added
2022-04-13 · due 2022-05-04
EPSS history
Timeline
  • 13 APR 00:00Z
    Added to CISA KEV — remediate by May 4
    kev
  • 10 DEC 21:00Z
    Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux…
    cvelistv5