8.8High KEV

CVE-2017-11292Adobe Flash Player Type Confusion Vulnerability

Adobe Flash Player version 27.0.0.159 and earlier Published: 2017-10-21 08:00 (9 years ago)

Known exploited — Adobe Flash Player Type Confusion Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.03.2022. Remediation deadline for US federal agencies: 24.03.2022.

Required action: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2017-11292

Description

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

Weakness (CWE): CWE-843

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
adobe	flash player	≤ 27.0.0.130
adobe	flash player desktop runtime	≤ 27.0.0.159
redhat	enterprise linux desktop	6.0
redhat	enterprise linux server	6.0
redhat	enterprise linux workstation	6.0
—	Adobe Flash Player version 27.0.0.159 and earlier	Adobe Flash Player version 27.0.0.159 and earlier

References and patches

1039582 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb17-32.html PatchVendor Advisory
GLSA-201710-22 vendor-advisoryThird Party Advisory
101286 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
RHSA-2017:2899 vendor-advisoryThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 US Government Resource

CPE matches (NVD) (7)

cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* ≤ 27.0.0.159
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* ≤ 27.0.0.130
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* ≤ 27.0.0.130
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* ≤ 27.0.0.159
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

CVSS score

8.8High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	8.8High
nvd	CVSS 3.1	8.8High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.8High
nvd	CVSS 2.0	6.0Medium

EPSS (chance of exploitation in 30 days)

11.21%

higher than 96% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2017-07-13
Published2017-10-21 08:00
Reached IP-DB2026-10-24 23:34
Added to KEV2022-03-03
Last updated2026-06-17 04:01

Assigned by (CNA): adobe
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

6.2Medium

CVE-2026-128886 yesterday

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Medium

CVE-2026-110330 2 days ago

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High

CVE-2026-110331 2 days ago

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Medium

CVE-2026-128987 2 days ago

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Medium

CVE-2026-128885 2 days ago

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8High

CVE-2026-18379 3 days ago

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…