Vulnerability record · CVE-2017-11292 · published 22 October 2017
CVE-2017-11292: Adobe Flash Player bytecode verification flaw enables type confusion RCE
Adobe · Flash Player Desktop Runtime
Adobe Flash Player 27.0.0.159 and earlier has a flawed bytecode verification procedure that lets an untrusted value be used to calculate an array index, causing type confusion. Successful exploitation can lead to arbitrary code execution, and the product is end-of-life, so unpatched installs remain exposed.
Description
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with KEV listing and high EPSS, but exploitation requires user interaction and the affected product is end-of-life, lowering practical exposure.
What it is
Adobe Flash Player 27.0.0.159 and earlier has a flawed bytecode verification procedure that lets an untrusted value be used to calculate an array index, causing type confusion. Successful exploitation can lead to arbitrary code execution, and the product is end-of-life, so unpatched installs remain exposed.
Impact
An attacker can execute arbitrary code in the context of the Flash Player process, giving full compromise of confidentiality, integrity and availability on the victim host.
Attack surface
Reached over the network via crafted Flash content; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must load the malicious content in a browser or player.
Exploitation
It is listed in CISA KEV (added 2022-03-03) and has a high EPSS percentile (~95.9%), indicating observed exploitation; no ransomware campaign use is documented.
What to do
- Patch to the fixed Flash Player release per Adobe advisory apsb17-32 (or the Red Hat RHSA-2017:2899 errata for Linux packages).
- Since Flash Player is end-of-life, remove or disconnect the product entirely where it is still installed.
- Disable or block Flash content in browsers and enforce click-to-play so untrusted SWF files do not auto-execute.
- Restrict user ability to load untrusted web content and monitor for legacy Flash usage on endpoints.
Detection
- Hunt for Flash Player processes (e.g. FlashPlayerPlugin, npapi) spawning child processes or making unexpected network connections.
- Monitor for SWF file downloads and execution from email, web or temp directories.
- Alert on crashes or memory corruption events in Flash Player that may indicate exploitation attempts.
- Review endpoint inventory for hosts still running Flash Player 27.0.0.159 or earlier.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-11292 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Adobe Flash Player Type Confusion Vulnerability". Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 24 March 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/101286 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1039582 | Broken LinkThird Party AdvisoryVDB Entry |
| https://access.redhat.com/errata/RHSA-2017:2899 | Third Party Advisory |
| https://helpx.adobe.com/security/products/flash-player/apsb17-32.html | PatchVendor Advisory |
| https://security.gentoo.org/glsa/201710-22 | Third Party Advisory |
| http://www.securityfocus.com/bid/101286 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1039582 | Broken LinkThird Party AdvisoryVDB Entry |
| https://access.redhat.com/errata/RHSA-2017:2899 | Third Party Advisory |
| https://helpx.adobe.com/security/products/flash-player/apsb17-32.html | PatchVendor Advisory |
| https://security.gentoo.org/glsa/201710-22 | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 | US Government Resource |
Track CVE-2017-11292 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-11292), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
