CVE-2017-11282

CRITICAL

Adobe Flash Player < 26.0.0.151 - Memory Corruption

Title source: rule

Description

Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textdosmultiple

https://www.exploit-db.com/exploits/42783

View Code ZIP pw:eip

References (9)

[Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/144332/Adobe-Flash-appleToRange-Out-Of-Bounds-Read.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/100716

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1039314

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2017:2702

[Third Party Advisory] https://bugs.chromium.org/p/project-zero/issues/detail?id=1323

[Vendor Advisory] https://helpx.adobe.com/security/products/flash-player/apsb17-28.html

[Third Party Advisory, VDB Entry] https://security.gentoo.org/glsa/201709-16

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/42783/

[Exploit, Third Party Advisory] https://www.youtube.com/watch?v=6iZnIQbRf5M

Scores

CVSS v3 9.8

EPSS 0.2069

EPSS Percentile 95.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (5)

adobe/flash_player < 26.0.0.151 (4 CPE variants)

n/a/Adobe Flash Player 26.0.0.151 and earlier versions Adobe Flash Player 26.0.0.151 and earlier versions

redhat/enterprise_linux_desktop 6.0

redhat/enterprise_linux_server 6.0

redhat/enterprise_linux_workstation 6.0

Published Dec 01, 2017

Tracked Since Feb 18, 2026