Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and AIR allow remote code execution

CVE-2012-5258 · published 14 years ago
Summary

Old versions of Adobe Flash Player on Windows, macOS, Linux, and Android, as well as Adobe AIR and its SDK, can be tricked into running any code an attacker chooses or crashing the program. This means a malicious website or app could take control of a computer or cause it to stop working. Update to the latest Flash Player, Adobe AIR, and AIR SDK releases or uninstall Flash if it is no longer needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe flash_player <= 10.3.183.25
10.1.85.3
10.1.102.64
10.2.152.26
10.2.152.32
10.2.153.1
10.2.159.1
10.3.181.14
10.3.181.16
10.3.181.22
10.3.181.26
10.3.181.34
27 more version ranges
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe flash_player_for_android <= 11.1.111.16
10.1.106.17
10.2.157.51
10.3.186.7
11.0.1.153
11.1.102.59
11.1.111.5
11.1.111.7
11.1.111.8
11.1.111.9
11.1.111.10
<= 11.1.115.17
6 more version ranges
cpe:2.3:a:adobe:flash_player_for_android:*:*:*:*:*:*:*:*
adobe adobe_air <= 3.4.0.2540
1.0
1.0.1
1.0.8.4990
1.0.4990
1.1
1.1.0.5790
1.5
1.5.0.7220
1.5.1
1.5.1.8210
1.5.2
28 more version ranges
cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*
adobe adobe_air_sdk <= 3.4.0.2540
cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*
Original advisory text
Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and ...
Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published9 Oct 2012
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-5258 · NVD
Track software like this
Free during beta