CVEs / CVE-2010-1297

CVE-2010-1297: Adobe Flash Player Memory Corruption Vulnerability

Known exploited in the CISA KEV catalog since 8 Jun 2022
high 7.8 CVSS 3.1 (NVD)
EPSS 82.5% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 16 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2010-1297

Summary

Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
CISA, Known Exploited Vulnerabilities catalog

Description

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
The CVE record, via NVD · published 8 Jun 2010 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
n/a n/a	n/a	—

Exploitation

In CISA KEV since	8 Jun 2022
Due date for US federal agencies	22 Jun 2022
Used in ransomware campaigns	Unknown
Required action	The impacted product is end-of-life and should be disconnected if still in use.

Severity

CVSS 3.1	7.8 high `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` Scored by NVD
Weakness	CWE-787

References

CVE-2010-1297 on NVD
CVE-2010-1297 in the CISA KEV catalog
http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/ Exploit
http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx Broken Link
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 Broken Link
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html Mailing List, Third Party Advisory
http://secunia.com/advisories/40026 Broken Link, Vendor Advisory
http://secunia.com/advisories/40034 Broken Link, Vendor Advisory
http://secunia.com/advisories/40144 Broken Link
http://secunia.com/advisories/40545 Broken Link
http://secunia.com/advisories/43026 Broken Link
http://security.gentoo.org/glsa/glsa-201101-09.xml Third Party Advisory
http://securitytracker.com/id?1024057 Broken Link, Third Party Advisory, VDB Entry
http://securitytracker.com/id?1024058 Broken Link, Third Party Advisory, VDB Entry
http://securitytracker.com/id?1024085 Broken Link, Third Party Advisory, VDB Entry
http://securitytracker.com/id?1024086 Broken Link, Third Party Advisory, VDB Entry
http://support.apple.com/kb/HT4435 Broken Link
http://www.adobe.com/support/security/advisories/apsa10-01.html Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb10-14.html Not Applicable
http://www.adobe.com/support/security/bulletins/apsb10-15.html Not Applicable

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.