Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and Air let attackers run code

CVE-2012-5251 · published 14 years ago
Summary

Versions of Adobe Flash Player for Windows, Mac, Linux and Android, as well as Adobe AIR and its SDK, contain a coding mistake that can let a malicious website or program run any code on a user's computer. This could let attackers take control of the system or steal information. Update to the latest versions of Flash Player and Adobe AIR or remove them if they are no longer needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe flash_player <= 10.3.183.25
10.1.85.3
10.1.102.64
10.2.152.26
10.2.152.32
10.2.153.1
10.2.159.1
10.3.181.14
10.3.181.16
10.3.181.22
10.3.181.26
10.3.181.34
27 more version ranges
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe flash_player_for_android <= 11.1.111.16
10.1.106.17
10.2.157.51
10.3.186.7
11.0.1.153
11.1.102.59
11.1.111.5
11.1.111.7
11.1.111.8
11.1.111.9
11.1.111.10
<= 11.1.115.17
6 more version ranges
cpe:2.3:a:adobe:flash_player_for_android:*:*:*:*:*:*:*:*
adobe adobe_air <= 3.4.0.2540
1.0
1.0.1
1.0.8.4990
1.0.4990
1.1
1.1.0.5790
1.5
1.5.0.7220
1.5.1
1.5.1.8210
1.5.2
28 more version ranges
cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*
adobe adobe_air_sdk <= 3.4.0.2540
cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Androi...
Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published9 Oct 2012
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-5251 · NVD
Track software like this
Free during beta