{"id":"CVE-2010-1297","kind":"vulnerability","aliases":["CVE-2010-1297"],"related":[],"title":"Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and…","description":"Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.","summary":"Adobe Flash Player has a memory corruption flaw that lets a remote attacker run code or crash the player. It is listed in CISA's known-exploited catalog, so attacks have been seen in the wild.","severity":"critical","cvss":9.3,"epss":0.82531,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"adobe air","fixed":["2.0.2.12610"],"affected":"< 2.0.2.12610","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["9.0.277.0"],"affected":"< 9.0.277.0","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["10.1.53.64"],"affected":">= 10.0, < 10.1.53.64","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["8.2.3"],"affected":">= 8.0, < 8.2.3","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["9.3.3"],"affected":">= 9.0, < 9.3.3","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":">= 11.0, <= 11.2","ecosystem":"vendor"},{"name":"suse linux enterprise","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"suse linux enterprise","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"Adobe Flash Player","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-flash-player","browsers","exploited","macos","package","windows"],"not_affected_if":["flash-not-installed"],"how_to_check":"Check whether Adobe Flash Player is installed on any machine or browser (for example, look for FlashPlayer plugin files or the Flash Player entry in installed programs). unknown for any other check.","fix":"Remove Adobe Flash Player, since the product is end-of-life and CISA says to disconnect it if still in use. unknown for a patched version number.","status":"open","published_at":"2010-06-08T18:30:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:50+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:12:50Z","model":"claude-haiku-5-5","output":{"fix":"Remove Adobe Flash Player, since the product is end-of-life and CISA says to disconnect it if still in use. unknown for a patched version number.","reach":"internet","impact":"high","summary":"Adobe Flash Player has a memory corruption flaw that lets a remote attacker run code or crash the player. It is listed in CISA's known-exploited catalog, so attacks have been seen in the wild.","category":"package","who_cares":["adobe-flash-player","browsers","windows","macos"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker runs code on the victim's machine through a crafted Flash content.","analyst_note":"Sources do not give affected or fixed versions; check Adobe's security bulletin for the CVE-2010-1297 advisory to confirm the fixed build and exact affected range.","how_to_check":"Check whether Adobe Flash Player is installed on any machine or browser (for example, look for FlashPlayer plugin files or the Flash Player entry in installed programs). unknown for any other check.","needs_analyst":true,"not_affected_if":["flash-not-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2838,"output_tokens":422,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1297':20A,23A '-2010':19A,22A '10':7A,98C '10.1.53.64':10A,101C '2':153C '2.0.2.12610':14A,105C '2010':164C '8':116C '8.2.3':119C '9':111C '9.0.277.0':5A,96C '9.3.3':114C 'acrobat':33A,35A,110C 'actionscript':150C 'adob':1A,11A,16A,47B,55B,92C,102C,107C 'adobe':24A,26A,29A,32A,34A,43A 'adobe-flash-play':46B 'air':12A,25A,103C 'allow':126C 'arbitrari':131C 'attack':67B,85B,128C 'authplay.dll':147C 'avm2':154C 'browser':50B 'catalog':83B 'caus':134C 'cisa':78B 'code':69B,132C 'content':144C 'corrupt':61B,140C 'craft':142C 'crash':71B 'cve':18A,21A 'denial':136C 'enterprise':39A,42A 'execut':130C 'exploit':51B,82B,158C 'flash':2A,27A,30A,44A,48B,56B,93C 'flaw':62B 'instruct':156C 'june':163C 'known':81B 'known-exploit':80B 'let':64B 'linux':38A,41A 'list':76B 'mac':123C 'machin':152C 'maco':52B 'memori':60B,139C 'newfunct':155C 'opensuse':36A 'os':124C 'packag':53B 'player':3A,28A,31A,45A,49B,57B,73B,94C 'reader':17A,108C 'relat':145C 'remot':66B,127C 'run':68B 'seen':88B 'servic':138C 'suse':37A,40A 'swf':143C 'via':141C 'virtual':151C 'wild':91B,161C 'window':54B,121C 'x':8A,99C,112C,117C,125C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-06-08T18:30:10+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-1297","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-1297","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2010-1297","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-1297","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-1297","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1297","severity":null,"published_at":"2010-06-08T18:30:10+00:00","modified_at":"2026-06-16T23:18:02+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}