CVE-2012-0767: Adobe Flash Player universal XSS via unspecified vectors

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw was exploited in the wild and is in CISA KEV, but it requires user interaction and affects an end-of-life product, lowering practical urgency for patched or Flash-free environments.

What it is

Adobe Flash Player contains a cross-site scripting flaw, dubbed Universal XSS (UXSS), that lets remote attackers inject arbitrary web script or HTML through unspecified vectors. It affects Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux and Solaris, plus Android 2.x/3.x before 11.1.111.6 and Android 4.x before 11.1.115.6. The record does not describe the exact injection mechanism, so defenders must rely on the version ranges and vendor bulletin.

Impact

An attacker can run script in the security context of a victim's browser session, enabling session or data theft and page content manipulation. The CVSS 3.1 vector rates confidentiality and integrity impact as low, with scope change.

Attack surface

Reached over the network with no privileges required, but user interaction is required per the CVSS vector (UI:R), consistent with a victim loading crafted content in a browser running the vulnerable Flash Player. No authentication is needed.

Exploitation

Adobe stated the flaw was exploited in the wild in February 2012, and CISA added it to the KEV catalog on 2022-06-08. EPSS 30-day probability is 0.06662 (93.5th percentile), indicating elevated but not top-tier predicted activity.

What to do

• Upgrade Flash Player to 10.3.183.15, 11.1.102.62, 11.1.111.6 or 11.1.115.6 (or later) per Adobe APSB12-03, or apply the equivalent Red Hat, openSUSE and Gentoo updates.
• Because Flash Player is end-of-life, remove or disconnect it from systems that still run it, as CISA's KEV required action states.
• Disable or block Flash content in browsers and email clients where removal is not immediately possible.
• Restrict outbound and inbound access to systems that must retain Flash, and monitor them as legacy assets.

Detection

• Inventory endpoints and browsers still running Flash Player versions below the fixed builds listed above.
• Hunt for Flash content or SWF files loaded from untrusted or unusual origins in web proxy and browser telemetry.
• Monitor for script execution anomalies or unexpected cross-origin requests originating from browser processes hosting Flash.
• Review historical logs around February 2012 for exploitation attempts if retained, given the in-the-wild report.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.