Vulnerability record · CVE-2007-0071 · published 9 April 2008
CVE-2007-0071: Adobe Flash Player integer overflow via negative Scene Count in SWF
Adobe · Flash Player
Adobe Flash Player 9.0.115.0 and earlier and 8.0.39.0 and earlier contain an integer overflow when processing a crafted SWF file with a negative Scene Count value. The signed value passes a comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow, allowing remote code execution. This is a legacy, widely deployed client-side runtime issue with a very high EPSS score.
Description
Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityCVSS 9.3 and EPSS above the 99th percentile indicate severe impact and high modeled exploitation likelihood, though the product is legacy and no KEV listing is present.
What it is
Adobe Flash Player 9.0.115.0 and earlier and 8.0.39.0 and earlier contain an integer overflow when processing a crafted SWF file with a negative Scene Count value. The signed value passes a comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow, allowing remote code execution. This is a legacy, widely deployed client-side runtime issue with a very high EPSS score.
Impact
A remote attacker can execute arbitrary code in the context of the user running Flash Player, giving full control of confidentiality, integrity and availability on the affected host.
Attack surface
Reached over the network by delivering a malicious SWF file to a victim, typically via a web page or embedded content; no authentication is required, but some user interaction (loading the SWF) is implied by the CVSS AV:N/AC:M vector.
Exploitation
Not listed in CISA KEV, but EPSS is 0.92501 (99.8th percentile), indicating a high modeled likelihood of exploitation; references include third-party analyses and vendor advisories but no explicit in-the-wild confirmation in this record.
What to do
- Upgrade Flash Player to a version later than 9.0.115.0 / 8.0.39.0 per Adobe APSB08-11 or remove Flash Player entirely.
- Apply vendor patches for bundled Flash in browsers, Linux distributions, Solaris and other affected platforms listed in the advisories.
- Disable or block Flash content in browsers and email clients where Flash cannot be patched.
- Restrict user ability to load untrusted SWF files and enforce network controls on SWF delivery.
- Monitor vendor advisories for any residual affected components and retire end-of-life Flash deployments.
Detection
- Hunt for Flash Player versions 9.0.115.0 and earlier or 8.0.39.0 and earlier in software inventory.
- Monitor for SWF files containing anomalous or negative Scene Count metadata.
- Detect Flash Player crashes or buffer overflow behavior in endpoint telemetry.
- Review proxy and email logs for SWF downloads from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-0071 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-0071), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
