What’s Vulnerable › Vulnerabilities

CVE-2014-9163: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: yes — in CISA KEV since 2022-04-13
• EPSS: 44.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-12-10 · updated 2026-06-17
• Weakness: CWE-121

Description

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

Affected products

• Adobe Flash Player 24.0.0.186 and earlier.: from 13.0 before 13.0.0.259; from 14.0 through 14.0.0.179; from 15.0 before 15.0.0.246; from 11.0 before 11.2.202.425 — fixed in 11.2.202.425, 13.0.0.259, 15.0.0.246

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 11.2.202.425, 13.0.0.259, 15.0.0.246. Check the vendor advisory for mitigations.

References

• http://helpx.adobe.com/security/products/flash-player/apsb14-27.html
• http://helpx.adobe.com/security/products/flash-player/apsb14-27.html
• https://github.com/cisagov/vulnrichment/issues/196
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-9163

Get alerted when CVE-2014-9163 or the next vulnerability affects your stack