Log in Start free

Actively exploited · Published Nov 25, 2014 · Assigned by adobe

CVE-2014-8439

High 8.8 Exploited

In plain English

A high-severity use-after-free in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). The chance it is exploited in the next 30 days is estimated at 20.4% (higher than 97% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)20.4%top 2.5% of all CVEs
Exploited in the wildYesCISA KEV since May 25, 2022
Attack toolingNoneno public tooling known

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Jun 15, 2022.

Official description

Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References