CVE-2011-2140: Adobe Flash Player and AIR memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 2.0 score of 10 with complete impact and no authentication required, combined with a very high EPSS probability, makes this a critical risk for unpatched systems.

What it is

Adobe Flash Player and Adobe AIR contain a memory corruption flaw (CWE-119) that can be triggered by unspecified vectors, allowing arbitrary code execution or denial of service. The vulnerability affects Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.3 on Android, as well as AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android. It is a distinct issue from CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.

Impact

An attacker can execute arbitrary code in the context of the affected process or cause a denial of service through memory corruption. Given the CVSS 2.0 vector, the impact to confidentiality, integrity, and availability is complete.

Attack surface

The vulnerability is network-reachable (AV:N) with low complexity and no authentication required (AC:L/Au:N), meaning it can be triggered remotely without credentials. The description does not specify whether user interaction is needed, but Flash content is typically delivered via web pages or files, so some form of user action to load the malicious content is likely.

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation activity (0.82258, 99.641st percentile). References include a vendor patch and US-CERT alert, but no public exploit tags are present.

What to do

• Update Adobe Flash Player to version 10.3.183.5 or later on Windows, Mac OS X, Linux, and Solaris, and to 10.3.186.3 or later on Android.
• Update Adobe AIR to version 2.7.1 or later on Windows and Mac OS X, and to 2.7.1.1961 or later on Android.
• Apply vendor patches referenced in Adobe security bulletin APSB11-21 and any relevant Linux distribution errata (e.g., openSUSE, Red Hat).
• If patching is not immediately possible, disable or remove Flash Player and AIR where they are not required, or restrict their use to trusted content only.

Detection

• Monitor for crashes or abnormal process terminations in Flash Player or AIR that could indicate memory corruption attempts.
• Inspect network traffic for Flash content (.swf) delivered from untrusted or unusual sources, especially to hosts running unpatched versions.
• Use endpoint detection to look for suspicious child processes spawned by Flash Player or AIR, which may indicate successful code execution.
• Check installed versions of Flash Player and AIR against the fixed versions to identify unpatched systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.