CVE-2011-0609: Adobe Flash Player Unspecified Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-06-08
EPSS: 63.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-03-15 · updated 2026-06-16

Description

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

Affected products

Adobe Acrobat for Edge: from 9.0 through 9.4.2; 10.0, 10.0.1
Adobe Acrobat Reader: from 9.0 through 9.4.2; 10.0, 10.0.1
Adobe Air: through 2.5.1
Adobe Flash Player 24.0.0.186 and earlier.: through 10.2.154.13; through 10.1.106.16
Google Chrome: before 10.0.648.134 — fixed in 10.0.648.134
Opensuse: 11.2, 11.3, 11.4
SUSE Linux Enterprise: 10.0-sp3, 11.0-sp1

How to fix

Upgrade to a fixed version: Google Chrome 10.0.648.134. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2011-0609 or the next vulnerability affects your stack