CVE-2010-2873

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-08-26 · updated 2026-06-16
Weakness: CWE-20

Description

Adobe Shockwave Player before 11.5.8.612 does not properly validate offset values in the rcsL RIFF chunks of (1) .DIR and (2) .DCR Director movies, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie.

Affected products

Adobe Shockwave Player: through 11.5.7.609; 1.0, 2.0, 3.0, 4.0, 5.0, 6.0 (+33)

References

http://www.adobe.com/support/security/bulletins/apsb10-20.html
http://www.securityfocus.com/archive/1/513307/100/0/threaded
http://www.securityfocus.com/bid/42682
http://www.securitytracker.com/id?1024361
http://www.vupen.com/english/advisories/2010/2176
http://www.zerodayinitiative.com/advisories/ZDI-10-162
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12042
http://www.adobe.com/support/security/bulletins/apsb10-20.html
http://www.securityfocus.com/archive/1/513307/100/0/threaded
http://www.securityfocus.com/bid/42682
http://www.securitytracker.com/id?1024361
http://www.vupen.com/english/advisories/2010/2176

Get alerted when CVE-2010-2873 or the next vulnerability affects your stack