CVEvulnerability

CVE-2017-11292

8.8 HIGH Known exploited Published 2017-10-22 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Adobe Flash Player Type Confusion Vulnerability — Adobe Flash Player

Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.

Added to KEV: 2022-03-03
Remediation due: 2022-03-24
Ransomware use: Unknown
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-11292

Status: Analyzed
Published: 2017-10-22
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses: CWE-843

Description

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

Affected configurations

• adobe flash player desktop runtime (<= 27.0.0.159) • adobe flash player (<= 27.0.0.130) • adobe flash player (<= 27.0.0.159) • redhat enterprise linux desktop 6.0 • redhat enterprise linux server 6.0 • redhat enterprise linux workstation 6.0

Weakness · CWE (1)

CWE-843 Access of Resource Using Incompatible Type weakness

References