CISA KEV · Known exploitedHigh

CVE-2010-1297

Adobe Flash Player

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

CVSS: 7.8
EPSS: 82.4%
CISA KEV: Listed
Published: 2010.06.09

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability82.4%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Adobe Flash Player
Affected versions: < 2.0.2.12610, < 9.0.277.0, >= 10.0 < 10.1.53.64, >= 8.0 < 8.2.3, >= 9.0 < 9.3.3, >= 11.0 <= 11.2, 10.0, 11.0
Fixed versions: 2.0.2.12610, 9.0.277.0, 10.1.53.64, 8.2.3, 9.3.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

The impacted product is end-of-life and should be disconnected if still in use.

Due date: 2022.06.22

1
Identify
Confirm that Adobe Flash Player and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-787
KEV added: 2022.06.08
Ransomware use: 미확인