CVE-2007-0071

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 92.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-09 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.

Affected products

Adobe Flash Player 24.0.0.186 and earlier.: from 8.0 through 8.0.39.0; from 9.0 through 9.0.115.0

References

http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html
http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf
http://isc.sans.org/diary.html?storyid=4465
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html
http://secunia.com/advisories/29763
http://secunia.com/advisories/29865
http://secunia.com/advisories/30404
http://secunia.com/advisories/30430
http://secunia.com/advisories/30507
http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1
http://www.adobe.com/support/security/bulletins/apsb08-11.html

Get alerted when CVE-2007-0071 or the next vulnerability affects your stack