CVE-2014-0497: Adobe Flash Player Integer Underflow Vulnerablity

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-09-17
EPSS: 99.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-02-05 · updated 2026-06-17
Weakness: CWE-191

Description

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products

Adobe Flash Player 24.0.0.186 and earlier.: before 11.2.202.336; before 11.7.700.261; from 11.8.800.94 before 12.0.0.44 — fixed in 11.2.202.336, 11.7.700.261, 12.0.0.44
Google Chrome: before 32.0.1700.107 — fixed in 32.0.1700.107
Opensuse: 11.4, 12.3, 13.1
RedHat Enterprise Linux Desktop: 5.0, 6.0
RedHat Enterprise Linux Eus: 6.5
RedHat Enterprise Linux Server: 5.0, 6.0
RedHat Enterprise Linux Server Aus: 6.5
RedHat Enterprise Linux Workstation: 5.0, 6.0
SUSE Linux Enterprise Server 15 SP1: 11-sp2, 11-sp3

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 11.2.202.336, 11.7.700.261, 12.0.0.44; Google Chrome 32.0.1700.107. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2014-0497 or the next vulnerability affects your stack