Product:
Adobe Flash Player
Summary
Adobe Flash Player has a flawed bytecode verification procedure that allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could result in arbitrary code execution. The vulnerability affects version 27.0.0.159 and earlier.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2017-11292 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious Flash file that triggers the flawed bytecode verification process. When the victim opens this file, it can lead to type confusion, allowing the attacker to execute arbitrary code on the victim’s system. User interaction is required, as the victim must open the malicious file for the exploit to be successful.
Affected Products
- Adobe Flash Player 27.0.0.159 and earlier: Vulnerable due to flawed bytecode verification allowing arbitrary code execution.
Mitigation
The impacted product is end-of-life and should be disconnected if still in use. Users are strongly advised to remove Adobe Flash Player from their systems to prevent potential exploitation.