Log in Start free

Actively exploited · Published Jun 8, 2010 · Assigned by adobe

CVE-2010-1297

High 7.8 Exploited

In plain English

A high-severity out-of-bounds write in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 82.5% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)82.5%top 0.3% of all CVEs
Exploited in the wildYesCISA KEV since Jun 8, 2022
Attack tooling1Metasploit

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Jun 22, 2022.

Official description

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References