Flash Player vulnerabilities

36 known vulnerabilities in Flash Player from Adobe. 35 are rated high or critical, and 36 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2018-15982Jan 18, 2019AdobeEPSS 89.6%

  Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

• 7.8 High severity

  Adobe Flash Player Stack-based Buffer Overflow Exploited

  CVE-2018-5002Jul 9, 2018Adobe Flash Player 29.0.0.171 and earlier versionsEPSS 24.4%

  Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

• 7.8 High severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2018-4878Feb 6, 2018Adobe Flash Player before 28.0.0.161EPSS 90.3%

  A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code

• 8.8 High severity

  Adobe Flash Player Type Confusion Exploited

  CVE-2017-11292Oct 22, 2017Adobe Flash Player version 27.0.0.159 and earlierEPSS 11.2%

  Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbi

• 8.8 High severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2016-7892Dec 15, 2016Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlierEPSS 19.1%

  Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

• 8.8 High severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2016-7855Nov 1, 2016AdobeEPSS 25.2%

  Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.

• 9.8 Critical severity

  Adobe Flash Player Remote Code Execution Exploited

  CVE-2016-4171Jun 16, 2016AdobeEPSS 20.2%

  Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

• 9.8 Critical severity

  Adobe Flash Player Arbitrary Code Execution Exploited

  CVE-2016-4117May 11, 2016AdobeEPSS 94.3%

  Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

• 9.8 Critical severity

  Adobe Flash Player Arbitrary Code Execution Exploited

  CVE-2016-1019Apr 7, 2016AdobeEPSS 22.3%

  Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

• 8.8 High severity

  Adobe Flash Player and AIR Integer Overflow Exploited

  CVE-2016-1010Mar 12, 2016AdobeEPSS 19.3%

  Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176

• 8.8 High severity

  Adobe Flash Player and AIR Use-After-Free Exploited

  CVE-2016-0984Feb 10, 2016AdobeEPSS 54.5%

  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.

• 8.8 High severity

  Adobe Flash Player Integer Overflow Exploited

  CVE-2015-8651Dec 28, 2015AdobeEPSS 67.7%

  Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allo

• 7.8 High severity

  Adobe Flash Player Arbitrary Code Execution Exploited

  CVE-2015-7645Oct 15, 2015AdobeEPSS 65.3%

  Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-5123Jul 14, 2015Red HatEPSS 18.8%

  Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-5122Jul 14, 2015AdobeEPSS 87%

  Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x thro

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-5119Jul 8, 2015AdobeEPSS 98.6%

  Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execu

• 9.8 Critical severity

  Adobe Flash Player Heap-Based Buffer Overflow Exploited

  CVE-2015-3113Jun 23, 2015AdobeEPSS 99.8%

  Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild

• 9.8 Critical severity

  Adobe Flash Player Memory Corruption Exploited

  CVE-2015-3043Apr 14, 2015AdobeEPSS 73.9%

  Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-0313Feb 2, 2015AdobeEPSS 95.3%

  Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil

• 9.8 Critical severity

  Adobe Flash Player Remote Code Execution Exploited

  CVE-2015-0311Jan 23, 2015AdobeEPSS 85.6%

  Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild

• 10.0 High severity

  Adobe Flash Player ASLR Bypass Exploited

  CVE-2015-0310Jan 23, 2015AdobeEPSS 15.1%

  Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Window

• 10.0 High severity

  Adobe Flash Player Stack-Based Buffer Overflow Exploited

  CVE-2014-9163Dec 10, 2014AdobeEPSS 44.9%

  Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in Decembe

• 10.0 High severity

  Adobe Flash Player Dereferenced Pointer Exploited

  CVE-2014-8439Nov 25, 2014AdobeEPSS 20.4%

  Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execu

• 8.8 High severity

  Adobe Flash Player Double Free Vulnerablity Exploited

  CVE-2014-0502Feb 21, 2014AdobeEPSS 24.8%

  Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK

• 9.8 Critical severity

  Adobe Flash Player Integer Underflow Vulnerablity Exploited

  CVE-2014-0497Feb 5, 2014AdobeEPSS 99.9%

  Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

• 8.8 High severity

  Adobe Flash Player Code Execution Exploited

  CVE-2013-0648Feb 27, 2013AdobeEPSS 11.1%

  Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers t

• 8.8 High severity

  Adobe Flash Player Incorrect Default Permissions Exploited

  CVE-2013-0643Feb 27, 2013AdobeEPSS 10.5%

  The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers t

• 8.8 High severity

  Adobe Flash Player Integer Overflow Exploited

  CVE-2012-5054Sep 24, 2012AdobeEPSS 21.2%

  Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

• 7.8 High severity

  Adobe Flash Player Arbitrary Code Execution Exploited

  CVE-2012-1535Aug 15, 2012AdobeEPSS 70.4%

  Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploite

• 7.5 High severity

  Adobe Flash Player Memory Corruption Exploited

  CVE-2012-2034Jun 9, 2012AdobeEPSS 7.71%

  Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.36

• 6.1 Medium severity

  Adobe Flash Player Cross-Site Scripting (XSS) Exploited

  CVE-2012-0767Feb 16, 2012AdobeEPSS 6.19%

  Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to in

• 8.1 High severity

  Adobe Flash Player Memory Corruption Exploited

  CVE-2012-0754Feb 16, 2012AdobeEPSS 91.2%

  Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (

• 8.8 High severity

  Adobe Flash Player Remote Code Execution Exploited

  CVE-2011-0611Apr 13, 2011AdobeEPSS 99.4%

  Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Ad

• 7.8 High severity

  Adobe Flash Player Unspecified Exploited

  CVE-2011-0609Mar 15, 2011AdobeEPSS 63.5%

  Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through

• 7.8 High severity

  Adobe Flash Player Memory Corruption Exploited

  CVE-2010-1297Jun 8, 2010AdobeEPSS 82.5%

  Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of ser

• 7.8 High severity

  Adobe Acrobat and Reader, Flash Player Unspecified Exploited

  CVE-2009-1862Jul 23, 2009AdobeEPSS 21.2%

  Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a craf