Vulnerability record · CVE-2012-1535 · published 15 August 2012
CVE-2012-1535: Adobe Flash Player input validation flaw enables code execution
Adobe · Flash Player
Adobe Flash Player contains an unspecified improper input validation and code injection flaw that lets crafted SWF content execute arbitrary code or crash the application. It matters because the flaw was exploited in the wild in August 2012, including SWF content embedded in a Word document, and the affected product is end-of-life.
Description
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw allows arbitrary code execution, is confirmed exploited in the wild and in CISA KEV, but requires user interaction and affects an end-of-life product.
What it is
Adobe Flash Player contains an unspecified improper input validation and code injection flaw that lets crafted SWF content execute arbitrary code or crash the application. It matters because the flaw was exploited in the wild in August 2012, including SWF content embedded in a Word document, and the affected product is end-of-life.
Impact
An attacker can run arbitrary code in the context of the user running Flash Player, or cause a denial of service through an application crash.
Attack surface
Reached by opening crafted SWF content, including SWF embedded in a Word document; the CVSS vector indicates local access with no privileges required but user interaction required.
Exploitation
Listed in CISA KEV since 2022-03-03 with known in-the-wild exploitation in August 2012, and EPSS 30-day probability is 0.70384 (99.352 percentile).
What to do
- Patch to Adobe Flash Player 11.3.300.271 or later on Windows and Mac OS X, and 11.2.202.238 or later on Linux, per Adobe APSB12-18.
- Disconnect or remove end-of-life Flash Player installations, as CISA's required action states.
- Apply the referenced Red Hat, openSUSE, SUSE and Gentoo updates where Flash is still packaged.
- Block or restrict execution of SWF content and untrusted Word documents containing embedded Flash objects.
- Restrict user ability to open untrusted documents and attachments from email or web sources.
Detection
- Hunt for processes loading Flash Player libraries (for example NPSWF or Flash .ocx/.dll) spawned from Word or other document readers.
- Monitor for Word documents containing embedded SWF or Flash objects opened from email or download locations.
- Alert on Flash Player crashes or abnormal child processes originating from browser or Office processes.
- Review endpoint logs for Flash Player versions below the fixed builds on Windows, Mac OS X and Linux.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2012-1535 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Adobe Flash Player Arbitrary Code Execution Vulnerability". Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 24 March 2022.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-1535 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-1535), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
