CVE-2020-9746: Exploitable NULL pointer deref could lead to arbitrary code execution

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-14 · updated 2026-06-17
Weakness: CWE-476

Description

Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.

Affected products

Adobe Flash Player 24.0.0.186 and earlier.: through 32.0.0.433; before 32.0.0.433; before 32.0.0.387 — fixed in 32.0.0.387, 32.0.0.433

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 32.0.0.387, 32.0.0.433. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-9746 or the next vulnerability affects your stack