CVE-2012-5054: Adobe Flash Player Matrix3D Integer Overflow Enables Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows remote code execution, is listed in CISA KEV with a public exploit, and affects an end-of-life product that should no longer be present.

What it is

Adobe Flash Player before 11.4.402.265 contains an integer overflow in the copyRawDataTo method of the Matrix3D class. Malformed arguments trigger the overflow, which can corrupt memory and allow remote code execution. The flaw matters because Flash Player was widely deployed and the product is now end-of-life.

Impact

An attacker can execute arbitrary code in the context of the affected Flash Player process, giving full control of confidentiality, integrity and availability on the victim host.

Attack surface

Reached remotely over the network via crafted Flash content that supplies malformed arguments to Matrix3D.copyRawDataTo. No authentication is required, but the CVSS vector indicates user interaction is required, meaning the victim must load the malicious content.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-06-08, and a public exploit reference is tagged Exploit. EPSS estimates a 30-day exploitation probability of about 21.2 percent (97.5th percentile).

What to do

• Remove or disconnect Adobe Flash Player; the product is end-of-life and CISA's required action is to disconnect it if still in use.
• If Flash cannot be removed immediately, disable the Flash plugin in all browsers and block Flash content execution.
• Apply the final Adobe security bulletin APSB12-19 update (11.4.402.265 or later) where Flash is still required.
• Restrict user ability to load untrusted SWF or web content and enforce network controls against known malicious hosts.
• Monitor for and block exploitation attempts targeting Flash Player on remaining endpoints.

Detection

• Hunt for Flash Player processes (e.g., FlashPlayerPlugin, FlashUtil) spawning unexpected child processes or making anomalous network connections.
• Monitor for crashes or memory corruption events in Flash Player, particularly involving Matrix3D or copyRawDataTo.
• Search proxy and web logs for delivery of SWF content from untrusted or newly seen domains to endpoints running Flash.
• Alert on execution of known Flash exploit artifacts or packetstorm-style exploit payloads on hosts that still have Flash installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.