Flash Player vulnerabilitiesAnd the versions its exploited flaws hit.
Flash Player is made by Adobe. We track 1,084 published vulnerabilities listed under that exact name, across 435 versions. 36 of them are on the list of flaws known to be exploited, the newest added on 17 September 2024. Adobe lists newer releases under their own names, such as Flash Player Desktop Runtime, so check those pages too.
The most recent Flash Player flaw added to the known-exploited list is CVE-2013-0648, on 17 September 2024. We keep watching the known-exploited list.
Is Flash Player listed under other names? Yes.
Adobe also lists Flash Player under more specific names, such as Flash Player Desktop Runtime and Flash Player for Android. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which versions of Flash Player do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 10.3.183.67" means every version up to, but not including, 10.3.183.67. Find your version, then patch.
- CVE-2013-0648Exploited list, 17 Sep 2024
Adobe Flash Player Code Execution Vulnerability
before 10.3.183.6711.0 to before 11.6.602.171 - CVE-2014-0497Exploited list, 17 Sep 2024
Adobe Flash Player Integer Underflow Vulnerablity
before 11.2.202.336before 11.7.700.26111.8.800.94 to before 12.0.0.44 - CVE-2014-0502Exploited list, 17 Sep 2024
Adobe Flash Player Double Free Vulnerablity
before 11.7.700.269before 11.2.202.34111.8.800.94 to before 12.0.0.70 - CVE-2013-0643Exploited list, 17 Sep 2024
Adobe Flash Player Incorrect Default Permissions Vulnerability
before 10.3.183.6711.0 to before 11.6.602.171 - CVE-2012-0754Exploited list, 8 Jun 2022
Adobe Flash Player Memory Corruption Vulnerability
before 10.3.183.15before 11.1.111.6before 11.1.115.611.0 to before 11.1.102.62 - CVE-2012-0767Exploited list, 8 Jun 2022
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
before 10.3.183.15before 11.1.111.6before 11.1.115.611.0 to before 11.1.102.62 - CVE-2010-1297Exploited list, 8 Jun 2022
Adobe Flash Player Memory Corruption Vulnerability
before 9.0.277.010.0 to before 10.1.53.64 - CVE-2011-0609Exploited list, 8 Jun 2022
Adobe Flash Player Unspecified Vulnerability
up to 10.2.154.13up to 10.1.106.16 - CVE-2012-5054Exploited list, 8 Jun 2022
Adobe Flash Player Integer Overflow Vulnerability
before 11.4.402.265 - CVE-2009-1862Exploited list, 8 Jun 2022
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
9.0 to 9.0.159.010.0 to 10.0.22.87 - CVE-2015-8651Exploited list, 25 May 2022
Adobe Flash Player Integer Overflow Vulnerability
before 11.2.202.559before 18.0.0.32419.0.0.185 to before 20.0.0.267 - CVE-2016-1010Exploited list, 25 May 2022
Adobe Flash Player and AIR Integer Overflow Vulnerability
up to 20.0.0.306up to 11.2.202.569 - CVE-2016-0984Exploited list, 25 May 2022
Adobe Flash Player and AIR Use-After-Free Vulnerability
up to 20.0.0.272up to 11.2.202.559up to 18.0.0.326up to 20.0.0.286 - CVE-2014-8439Exploited list, 25 May 2022
Adobe Flash Player Dereferenced Pointer Vulnerability
up to 11.2.202.418up to 15.0.0.223up to 13.0.0.252 - CVE-2015-0310Exploited list, 25 May 2022
Adobe Flash Player ASLR Bypass Vulnerability
before 11.2.202.438before 13.0.0.26214.0 to before 16.0.0.287 - CVE-2018-5002Exploited list, 23 May 2022
Adobe Flash Player Stack-based Buffer Overflow Vulnerability
up to 29.0.0.171 - CVE-2014-9163Exploited list, 13 Apr 2022
Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
11.0 to before 11.2.202.42513.0 to before 13.0.0.25914.0 to 14.0.0.17915.0 to before 15.0.0.246 - CVE-2015-0313Exploited list, 13 Apr 2022
Adobe Flash Player Use-After-Free Vulnerability
before 11.2.202.442before 13.0.0.26914.0.0.125 to before 16.0.0.305 - CVE-2015-5122Exploited list, 13 Apr 2022
Adobe Flash Player Use-After-Free Vulnerability
11.0 to 11.2.202.48113.0 to 13.0.0.30218.0 to 18.0.0.204 - CVE-2015-5123Exploited list, 13 Apr 2022
Adobe Flash Player Use-After-Free Vulnerability
11.0 to 11.2.202.48113.0 to 13.0.0.30218.0 to 18.0.0.203 - CVE-2015-0311Exploited list, 13 Apr 2022
Adobe Flash Player Remote Code Execution Vulnerability
up to 11.2.202.438up to 13.0.0.26214.0.0.125 to before 16.0.0.287 - CVE-2015-3113Exploited list, 13 Apr 2022
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
before 13.0.0.296before 11.2.202.46814.0.0.125 to before 18.0.0.194 - CVE-2012-2034Exploited list, 28 Mar 2022
Adobe Flash Player Memory Corruption Vulnerability
up to 11.2.202.235up to 11.1.115.8up to 11.1.111.9 - CVE-2016-7892Exploited list, 25 Mar 2022
Adobe Flash Player Use-After-Free Vulnerability
up to 23.0.0.207up to 11.2.202.644 - CVE-2016-4171Exploited list, 25 Mar 2022
Adobe Flash Player Remote Code Execution Vulnerability
up to 11.2.202.621up to 21.0.0.242up to 18.0.0.352 - CVE-2011-0611Exploited list, 3 Mar 2022
Adobe Flash Player Remote Code Execution Vulnerability
before 10.2.154.27up to 10.2.156.12 - CVE-2015-3043Exploited list, 3 Mar 2022
Adobe Flash Player Memory Corruption Vulnerability
before 11.2.202.457before 13.0.0.28114.0.0.125 to before 17.0.0.169 - CVE-2015-5119Exploited list, 3 Mar 2022
Adobe Flash Player Use-After-Free Vulnerability
up to 11.2.202.46813.0.0.182 to 13.0.029614.0.0.125 to 18.0.0.194 - CVE-2015-7645Exploited list, 3 Mar 2022
Adobe Flash Player Arbitrary Code Execution Vulnerability
up to 11.2.202.53518.0.0.160 to 18.0.0.25219.0.0.18519.0.0.207 - CVE-2012-1535Exploited list, 3 Mar 2022
Adobe Flash Player Arbitrary Code Execution Vulnerability
before 11.3.300.271before 11.2.202.238
Showing the 30 most recently added of 36 exploited flaws. The full list is below.
Which Flash Player vulnerabilities are being exploited?
36 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 8.8Adobe Flash Player Code Execution Vulnerability
Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.
- 9.8Adobe Flash Player Integer Underflow Vulnerablity
Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.
- 8.8Adobe Flash Player Double Free Vulnerablity
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
- 8.8Adobe Flash Player Incorrect Default Permissions Vulnerability
Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.
- 8.1Adobe Flash Player Memory Corruption Vulnerability
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
- 6.1Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
- 7.8Adobe Flash Player Memory Corruption Vulnerability
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
- 7.8Adobe Flash Player Unspecified Vulnerability
Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Which Flash Player flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via...
- >99%
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via...
- >99%
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before...
- 96%
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via...
- 95%CVE-2015-0359Critical
Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via...
- 95%CVE-2014-0515Critical
Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via...
- 94%
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
Running Flash Player? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.
- Matched to
- Flash Player on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 1,084 published vulnerabilities listed under the name Flash Player, across 435 versions. The most recent Flash Player flaw added to the known-exploited list is CVE-2013-0648, on 17 September 2024.
36 are on the list of flaws known to be exploited. The most recently added are CVE-2013-0648, CVE-2014-0497 and CVE-2014-0502.
Adobe also lists Flash Player under more specific names, such as Flash Player Desktop Runtime and Flash Player for Android. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2013-0648, affects before 10.3.183.67, 11.0 to before 11.6.602.171. The versions for every exploited flaw are listed on this page.
Create a EdgeProtect account and track Flash Player. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.