CVE-2020-9746CWE-476

Exploitable NULL pointer deref could lead to arbitrary code execution

High · published October 14, 2020

CVSS v3.1
7.0
EPSS
4%
Percentile
91.0
In the wild
Unconfirmed
What it is

Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04255 · 91.0th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2020-10-14T13:17Z
EPSS history
Timeline
  • 14 OCT 13:17Z
    Exploitable NULL pointer deref could lead to arbitrary code execution
    cvelistv5