Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2017-11292 Details
Description
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 4, 2025Exploitation: ActiveAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Adobe Flash Player Type Confusion Vulnerability | Mar 3, 2022 | Mar 24, 2022 | The impacted product is end-of-life and should be disconnected if still in use. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | [email protected] |
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| adobe flash player desktop runtime | <= 27.0.0.159 |
CPE
Remediation
| |
| apple mac os x | All versions |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
| adobe flash player | <= 27.0.0.130 <= 27.0.0.159 |
CPE
Remediation
| |
| microsoft windows 10 | All versions |
CPE
Remediation
| |
| microsoft windows 8.1 | All versions |
CPE
Remediation
| |
| google chrome os | All versions |
CPE
Remediation
| |
| redhat enterprise linux desktop | 6.0 |
CPE
Remediation
| |
| redhat enterprise linux server | 6.0 |
CPE
Remediation
| |
| redhat enterprise linux workstation | 6.0 |
CPE
Remediation
| |
Change History
17 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 22, 2026 | Modified Analysis | [email protected] |
| Oct 22, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Feb 13, 2025 | Modified Analysis | [email protected] |
| Feb 4, 2025 | CVE Modified | CISA-ADP |
| Jan 23, 2025 | Modified Analysis | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Jan 27, 2023 | Reanalysis | [email protected] |
| Apr 18, 2022 | Modified Analysis | [email protected] |
| Sep 22, 2021 | CPE Deprecation Remap | [email protected] |
| Dec 8, 2017 | CVE Modified | [email protected] |
| Nov 7, 2017 | Initial Analysis | [email protected] |
| Oct 23, 2017 | CVE Modified | [email protected] |