CVE-2017-11292: high-severity vulnerability in Adobe Flash Player version 27.0.0.159 and…
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
The impacted product is end-of-life and should be disconnected if still in use.
Adobe Flash Player has a flaw in how it checks bytecode that allows attackers to use wrong values when calculating array positions, which can lead to running malicious code on your computer.
CVE-2017-11292 involves insufficient bytecode verification in Adobe Flash Player ≤27.0.0.159, permitting untrusted values to be used in array index calculations, resulting in type confusion that can be exploited for arbitrary code execution. Attack vector requires opening a malicious SWF file; no privilege escalation needed.
The full analysis of this CVE is available in Portuguese →