Actively exploited · Published Sep 24, 2012 · Assigned by adobe
CVE-2012-5054
High 8.8 Exploited
In plain English
A high-severity integer overflow in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 21.2% (higher than 98% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Jun 22, 2022.
Official description
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.adobe.com/support/security/bulletins/apsb12-19.html x_refsource_MISC
- http://packetstormsecurity.org/files/116435/Adobe-Flash-Player-Matrix3D-Integer-Overflow-Code-Execution.html x_refsource_MISC
- adobe-flash-matrix3d-overflow(78866) vdb-entry, x_refsource_XF
- http://www.vupen.com/english/services/ba-index.php x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-5054 government-resource