CVE-2017-11282

Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.

Affected

Adobe Flash Player 26.0.0.151 and earlier versions

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

34.05% chance of exploitation in the next 30 days, 98th percentile

Published

2017-12-01

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://www.youtube.com/watch?v=6iZnIQbRf5M

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/42783

Security advisories

• https://helpx.adobe.com/security/products/flash-player/apsb17-28.html
• http://packetstormsecurity.com/files/144332/Adobe-Flash-appleToRange-Out-Of-Bounds-Read.h…
• http://www.securityfocus.com/bid/100716
• http://www.securitytracker.com/id/1039314
• https://access.redhat.com/errata/RHSA-2017:2702
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1323
• https://security.gentoo.org/glsa/201709-16

References

• CVE Record
• NVD entry