Actively exploited · Published Dec 10, 2014 · Assigned by adobe

CVE-2014-9163

High 7.8 Exploited

In plain English

A high-severity stack buffer overflow in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on April 13, 2022). The chance it is exploited in the next 30 days is estimated at 44.9% (higher than 99% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)44.9%top 1.2% of all CVEs

Exploited in the wildYesCISA KEV since Apr 13, 2022

Attack toolingNoneno public tooling known

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by May 4, 2022.

Official description

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

http://helpx.adobe.com/security/products/flash-player/apsb14-27.html x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-9163 government-resource
https://github.com/cisagov/vulnrichment/issues/196 issue-tracking