Log in Start free

Actively exploited · Published Feb 5, 2014 · Assigned by adobe

CVE-2014-0497

High 8.8 Exploited

In plain English

A high-severity security flaw in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on September 17, 2024). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)99.9%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Sep 17, 2024
Attack tooling1Metasploit

CISA guidance

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Federal agencies must remediate by Oct 8, 2024.

Official description

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-191 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References