An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions.

Published 8 y ago 2017-12-09 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

6.2%

percentile 94%

Public exploits

none known

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of providing language- and region- or country- specific functionality. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.

Exploit prediction (EPSS)

6.22% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	10.0	`AV:N/AC:L/Au:N/C:C/I:C/A:C`

Affected products

n/a Adobe Flash Player 27.0.0.183 and earlier versions

Classification

Weakness

CWE-125 Out-of-bounds Read

References

helpx.adobe.com /security/products/flash-player/apsb17-33.html · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:3222 · vendor-advisory, x_refsource_REDHAT, x_transferred
security.gentoo.org /glsa/201711-13 · vendor-advisory, x_refsource_GENTOO, x_transferred
securityfocus.com /bid/101837 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1039778 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

CVE List: CVE-2017-3114
NVD: CVE-2017-3114

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.