Product · KEV exposure
Adobe Flash Player known exploited vulnerabilities
We track 33 CVEs in Adobe Flash Player. All of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2021–2024). CISA flags 5 of them as used in ransomware campaigns. The most recent is CVE-2014-0502, added to KEV on .
- CVEs tracked
- 33
- On CISA KEV
- 33
- Ransomware use
- 5
- Rated critical
- 11
Every Adobe Flash Player CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2014-0502 Adobe Flash Player Double Free Vulnerablity | [ HIGH ] | 8.8 | 24.8% | ||
| CVE-2014-0497 Adobe Flash Player Integer Underflow Vulnerablity | [ CRITICAL ] | 9.8 | 99.9% | ||
| CVE-2013-0648 Adobe Flash Player Code Execution Vulnerability | [ HIGH ] | 8.8 | 11.1% | ||
| CVE-2013-0643 Adobe Flash Player Incorrect Default Permissions Vulnerability | [ HIGH ] | 8.8 | 10.5% | ||
| CVE-2012-5054 Adobe Flash Player Integer Overflow Vulnerability | [ HIGH ] | 8.8 | 21.2% | ||
| CVE-2012-0767 Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 6.2% | ||
| CVE-2012-0754 Adobe Flash Player Memory Corruption Vulnerability | [ HIGH ] | 8.1 | 91.1% | ||
| CVE-2011-0609 Adobe Flash Player Unspecified Vulnerability | [ HIGH ] | 7.8 | 63.5% | ||
| CVE-2010-1297 Adobe Flash Player Memory Corruption Vulnerability | [ HIGH ] | 7.8 | 82.5% | ||
| CVE-2015-8651 Adobe Flash Player Integer Overflow Vulnerability | [ HIGH ] | 8.8 | 67.7% | ||
| CVE-2015-0310 Adobe Flash Player ASLR Bypass Vulnerability | [ HIGH ] | 7.8 | 15.1% | ||
| CVE-2014-8439 Adobe Flash Player Dereferenced Pointer Vulnerability | [ HIGH ] | 8.8 | 20.4% | ||
| CVE-2018-5002 Adobe Flash Player Stack-based Buffer Overflow Vulnerability | [ HIGH ] | 7.8 | 25.1% | ||
| CVE-2015-5123 Adobe Flash Player Use-After-Free Vulnerability | [ CRITICAL ] | 9.8 | 18.8% | ||
| CVE-2015-5122 Adobe Flash Player Use-After-Free Vulnerability | [ CRITICAL ] | 9.8 | 93.9% | ||
| CVE-2015-3113 Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 99.8% | ||
| CVE-2015-0313 Adobe Flash Player Use-After-Free Vulnerability | [ CRITICAL ] | 9.8 | 95.3% | ||
| CVE-2015-0311 Adobe Flash Player Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 85.6% | ||
| CVE-2014-9163 Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | [ HIGH ] | 7.8 | 20.7% | ||
| CVE-2012-2034 Adobe Flash Player Memory Corruption Vulnerability | [ HIGH ] | 7.5 | 7.7% | ||
| CVE-2016-7892 Adobe Flash Player Use-After-Free Vulnerability | [ HIGH ] | 8.8 | 18.8% | ||
| CVE-2016-4171 Adobe Flash Player Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 20.1% | ||
| CVE-2017-11292 Adobe Flash Player Type Confusion Vulnerability | [ HIGH ] | 8.8 | 11.9% | ||
| CVE-2016-7855 Adobe Flash Player Use-After-Free Vulnerability | [ HIGH ] | 8.8 | 25.2% | ||
| CVE-2016-4117 Adobe Flash Player Arbitrary Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 94.4% | ||
| CVE-2016-1019 Adobe Flash Player Arbitrary Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 22.3% | ||
| CVE-2015-7645 Adobe Flash Player Arbitrary Code Execution Vulnerabilityransomware use | [ HIGH ] | 7.8 | 65.3% | ||
| CVE-2015-5119 Adobe Flash Player Use-After-Free Vulnerability | [ CRITICAL ] | 9.8 | 98.6% | ||
| CVE-2015-3043 Adobe Flash Player Memory Corruption Vulnerability | [ CRITICAL ] | 9.8 | 73.9% | ||
| CVE-2012-1535 Adobe Flash Player Arbitrary Code Execution Vulnerability | [ HIGH ] | 7.8 | 70.4% | ||
| CVE-2011-0611 Adobe Flash Player Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 99.4% | ||
| CVE-2018-15982 Adobe Flash Player Use-After-Free Vulnerabilityransomware use | [ HIGH ] | 7.8 | 89.6% | ||
| CVE-2018-4878 Adobe Flash Player Use-After-Free Vulnerabilityransomware use | [ HIGH ] | 7.8 | 89.5% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/adobe.json.
Other Adobe products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.