CVE-2017-11292KEV · OVERDUE

Adobe Flash Player Type Confusion Vulnerability

High · published October 21, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 96.1th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
8.8
EPSS
12%
Percentile
96.1
In the wild
Confirmed
What it is

🚨 An untrusted value can sneak its way into array indexing, leading to catastrophic code execution! 💻🔥 Think of it like a restaurant where the chef blindly accepts any ingredient without checking the recipe. If they use something unexpected, the dish could turn out dangerously wrong! An attacker could exploit this flaw to run arbitrary code on your system, gaining access to sensitive data or taking full control of your device. This isn't just a minor inconvenience; it could lead to major security breaches and data leaks that are absolutely devastating!

Put simply

Think of it like a restaurant where the chef blindly accepts any ingredient without checking the recipe. If they use something unexpected, the dish could turn out dangerously wrong! This vulnerability in Adobe Flash Player arises due to a flawed bytecode verification process, allowing attackers to use untrusted values for array indexing. This results in type confusion, which can be exploited for arbitrary code execution.

What to do

An attacker could exploit this flaw to run arbitrary code on your system, gaining access to sensitive data or taking full control of your device. This isn't just a minor inconvenience; it could lead to major security breaches and data leaks that are absolutely devastating! Upgrade Adobe Flash Player to version 28.0.0.137 or later immediately to patch this vulnerability. Additionally, consider disabling Flash Player entirely if it's not essential for your applications, as it has been deprecated. 🛡️ You can tackle this vulnerability head-on! Follow these steps and you'll keep your systems secure. You've got this! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.11885 · 96.1th percentile
Published
2017-10-21T05:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 21 OCT 05:00Z
    Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the…
    cvelistv5