CVE-2010-1297: Adobe Flash Player, AIR, Reader and Acrobat memory corruption via crafted SWF

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows remote code execution, was exploited in the wild, is in CISA KEV, and the affected products are end-of-life with no supported patching path.

What it is

Adobe Flash Player, AIR, Reader and Acrobat contain an out-of-bounds write (CWE-787) in the ActionScript Virtual Machine 2 newfunction instruction, reachable through crafted SWF content. Successful exploitation causes memory corruption that can lead to arbitrary code execution or a denial of service. The flaw was exploited in the wild in June 2010 and the affected products are end-of-life.

Impact

An attacker can execute arbitrary code in the context of the affected application or crash it, giving full control of the process on the victim's system. No privilege escalation beyond the application's own context is described.

Attack surface

Reached by getting a victim to open or render a crafted SWF file, typically embedded in a web page or document, so user interaction is required. The CVSS vector (AV:L/UI:R/PR:N) indicates local access with no authentication but required user action.

Exploitation

The record states the vulnerability was exploited in the wild in June 2010, it is listed in CISA KEV, and an Exploit reference is present; EPSS is 0.82365 (99.6th percentile). No ransomware campaign use is documented.

What to do

• Patch to the fixed versions: Flash Player 9.0.277.0 or 10.1.53.64, AIR 2.0.2.12610, Reader/Acrobat 9.3.3 or 8.2.3.
• Since the affected products are end-of-life, disconnect or remove them if they cannot be updated.
• Disable or block Flash and SWF content rendering in browsers, email clients and document readers.
• Apply the vendor and Linux distribution advisories referenced in the record for bundled Flash/AIR packages.
• Restrict execution of untrusted SWF files and documents from external sources.

Detection

• Hunt for processes loading authplay.dll or Flash/AIR/Reader components spawning unexpected child processes.
• Monitor for crashes or memory corruption events in Flash Player, AIR, Reader and Acrobat.
• Search endpoint and proxy logs for SWF files delivered from untrusted or newly registered domains.
• Review EDR telemetry for code execution originating from document readers or browser plugin processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.