← CVE Radar
CVE-2017-11292Adobe Flash Player Type Confusion Vulnerability
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
8.8 HIGHEPSS 11.21%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 6.0 | MEDIUM | 2.0NVD | AV:N/AC:M/Au:S/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Mar 24, 2022
The impacted product is end-of-life and should be disconnected if still in use.
Details
- CVE ID
- CVE-2017-11292
- Status
- Analyzed
- Assigner (CNA)
- adobe
- Published
- Oct 22, 2017
- Last modified
- 2026-06-17 01:01 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Adobe Flash Player version 27.0.0.159 and earlier1 version range
- Adobe Flash Player version 27.0.0.159 and earlier
References
- securityfocus.com http://www.securityfocus.com/bid/101286
- securitytracker.com http://www.securitytracker.com/id/1039582
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:2899
- helpx.adobe.com https://helpx.adobe.com/security/products/flash-player/apsb17-32.html
- security.gentoo.org https://security.gentoo.org/glsa/201710-22
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292