Adobe Flash Player known exploited vulnerabilities, ranked
CISA lists 33 Adobe Flash Player CVEs as exploited in the wild. 0 were added in the last 12 months and 5 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2015-3113: EPSS 99.94%, added 2022-04-13
- CVE-2014-0497: EPSS 99.88%, added 2024-09-17
- CVE-2011-0611: EPSS 99.41%, added 2022-03-03
- CVE-2015-5119: EPSS 99.33%, added 2022-03-03
- CVE-2015-0313: EPSS 95.3%, added 2022-04-13
All 33 Adobe Flash Player CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2015-3113 | Flash Player Heap-Based Buffer Overflow | 99.94% | – | 2022-04-13 | 2022-05-04 |
| 2 | CVE-2014-0497 | Flash Player Integer Underflow Vulnerablity | 99.88% | – | 2024-09-17 | 2024-10-08 |
| 3 | CVE-2011-0611 | Flash Player Remote Code Execution | 99.41% | – | 2022-03-03 | 2022-03-24 |
| 4 | CVE-2015-5119 | Flash Player Use-After-Free | 99.33% | – | 2022-03-03 | 2022-03-24 |
| 5 | CVE-2015-0313 | Flash Player Use-After-Free | 95.3% | – | 2022-04-13 | 2022-05-04 |
| 6 | CVE-2016-4117 | Flash Player Arbitrary Code Execution | 94.4% | Yes | 2022-03-03 | 2022-03-24 |
| 7 | CVE-2015-5122 | Flash Player Use-After-Free | 94.0% | – | 2022-04-13 | 2022-05-04 |
| 8 | CVE-2012-0754 | Flash Player Memory Corruption | 91.1% | – | 2022-06-08 | 2022-06-22 |
| 9 | CVE-2018-15982 | Flash Player Use-After-Free | 89.6% | Yes | 2022-02-15 | 2022-08-15 |
| 10 | CVE-2018-4878 | Flash Player Use-After-Free | 89.5% | Yes | 2021-11-03 | 2022-05-03 |
| 11 | CVE-2015-0311 | Flash Player Remote Code Execution | 85.6% | – | 2022-04-13 | 2022-05-04 |
| 12 | CVE-2010-1297 | Flash Player Memory Corruption | 82.5% | – | 2022-06-08 | 2022-06-22 |
| 13 | CVE-2015-3043 | Flash Player Memory Corruption | 73.9% | – | 2022-03-03 | 2022-03-24 |
| 14 | CVE-2012-1535 | Flash Player Arbitrary Code Execution | 70.4% | – | 2022-03-03 | 2022-03-24 |
| 15 | CVE-2015-8651 | Flash Player Integer Overflow | 67.7% | – | 2022-05-25 | 2022-06-15 |
| 16 | CVE-2015-7645 | Flash Player Arbitrary Code Execution | 65.3% | Yes | 2022-03-03 | 2022-03-24 |
| 17 | CVE-2011-0609 | Flash Player Unspecified | 63.5% | – | 2022-06-08 | 2022-06-22 |
| 18 | CVE-2016-7855 | Flash Player Use-After-Free | 25.2% | – | 2022-03-03 | 2022-03-24 |
| 19 | CVE-2018-5002 | Flash Player Stack-based Buffer Overflow | 25.1% | – | 2022-05-23 | 2022-06-13 |
| 20 | CVE-2014-0502 | Flash Player Double Free Vulnerablity | 24.8% | – | 2024-09-17 | 2024-10-08 |
| 21 | CVE-2016-1019 | Flash Player Arbitrary Code Execution | 22.3% | Yes | 2022-03-03 | 2022-03-24 |
| 22 | CVE-2012-5054 | Flash Player Integer Overflow | 21.2% | – | 2022-06-08 | 2022-06-22 |
| 23 | CVE-2014-9163 | Flash Player Stack-Based Buffer Overflow | 20.7% | – | 2022-04-13 | 2022-05-04 |
| 24 | CVE-2014-8439 | Flash Player Dereferenced Pointer | 20.4% | – | 2022-05-25 | 2022-06-15 |
| 25 | CVE-2016-4171 | Flash Player Remote Code Execution | 20.1% | – | 2022-03-25 | 2022-04-15 |
| 26 | CVE-2015-5123 | Flash Player Use-After-Free | 18.8% | – | 2022-04-13 | 2022-05-04 |
| 27 | CVE-2016-7892 | Flash Player Use-After-Free | 18.8% | – | 2022-03-25 | 2022-04-15 |
| 28 | CVE-2015-0310 | Flash Player ASLR Bypass | 15.1% | – | 2022-05-25 | 2022-06-15 |
| 29 | CVE-2017-11292 | Flash Player Type Confusion | 11.9% | – | 2022-03-03 | 2022-03-24 |
| 30 | CVE-2013-0648 | Flash Player Code Execution | 11.1% | – | 2024-09-17 | 2024-10-08 |
| 31 | CVE-2013-0643 | Flash Player Incorrect Default Permissions | 10.5% | – | 2024-09-17 | 2024-10-08 |
| 32 | CVE-2012-2034 | Flash Player Memory Corruption | 7.8% | – | 2022-03-28 | 2022-04-18 |
| 33 | CVE-2012-0767 | Flash Player Cross-Site Scripting (XSS) | 6.2% | – | 2022-06-08 | 2022-06-22 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Adobe KEV CVEs · other Adobe products: ColdFusion · Acrobat and Reader · Reader and Acrobat · free KEV badge for Adobe · all vendors