CVE-2014-0556: Adobe Flash Player heap buffer overflow allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is a network-reachable, unauthenticated code execution bug with public exploit material and very high EPSS, but the affected product is legacy and no KEV listing is present.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain a heap-based buffer overflow (CWE-119) reachable through unspecified vectors. Successful exploitation permits arbitrary code execution in the context of the affected process. The flaw is distinct from CVE-2014-0559 and affects Windows, OS X, Linux and Android builds before the listed fixed versions.

Impact

An attacker can execute arbitrary code with the privileges of the Flash Player or AIR process, potentially leading to full host compromise. Given the client-side nature of the product, this typically means code execution on the victim's machine.

Attack surface

The CVSS v2 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates network reachability with no authentication required, consistent with a client-side flaw triggered by crafted content rendered in Flash Player or AIR. User interaction (opening a malicious SWF or page) is implied by the product type, though the description does not state it explicitly.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.84298, 99.685th percentile) and public references include a Project Zero exploitation write-up and an Exploit-DB entry, indicating public exploit material exists.

What to do

• Upgrade Flash Player to 13.0.0.244 or later, 15.0.0.152 or later, and Linux to 11.2.202.406 or later; upgrade AIR to 15.0.0.249 (Windows/OS X) or 15.0.0.252 (Android) and AIR SDK/SDK & Compiler to 15.0.0.249.
• Remove or disable Flash Player and AIR where they are no longer required, since the product is end-of-life.
• Restrict browser and email rendering of Flash content, and block untrusted SWF files at the gateway.
• Apply the vendor advisory APSB14-21 and any distribution-specific updates (openSUSE, Gentoo) for packaged Flash builds.

Detection

• Monitor for Flash Player or AIR process crashes consistent with heap corruption, especially from browser or document viewers.
• Hunt for suspicious child processes spawned by Flash Player, AIR, or browser plugin containers.
• Review proxy and endpoint logs for SWF downloads from untrusted or newly registered domains.
• Check installed Flash Player, AIR, and AIR SDK versions against the fixed versions listed in APSB14-21.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.