---
id: "CVE-2010-1297"
kind: "vulnerability"
aliases: ["CVE-2010-1297"]
title: "Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and\u2026"
severity: "critical"
cvss: 9.3
epss: 0.82531
exploited: true
status: "open"
category: "package"
products: [{"name": "adobe air", "fixed": ["2.0.2.12610"], "affected": "< 2.0.2.12610", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": ["9.0.277.0"], "affected": "< 9.0.277.0", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": ["10.1.53.64"], "affected": ">= 10.0, < 10.1.53.64", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["8.2.3"], "affected": ">= 8.0, < 8.2.3", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["9.3.3"], "affected": ">= 9.0, < 9.3.3", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": ">= 11.0, <= 11.2", "ecosystem": "vendor"}, {"name": "suse linux enterprise", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "suse linux enterprise", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "Adobe Flash Player", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-flash-player", "browsers", "exploited", "macos", "package", "windows"]
not_affected_if: ["flash-not-installed"]
published_at: "2010-06-08T18:30:10+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-1297", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-1297", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1297", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and…

Adobe Flash Player has a memory corruption flaw that lets a remote attacker run code or crash the player. It is listed in CISA's known-exploited catalog, so attacks have been seen in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:adobe air affected < 2.0.2.12610 fixed 2.0.2.12610
- vendor:adobe flash player affected < 9.0.277.0 fixed 9.0.277.0
- vendor:adobe flash player affected >= 10.0, < 10.1.53.64 fixed 10.1.53.64
- vendor:adobe acrobat affected >= 8.0, < 8.2.3 fixed 8.2.3
- vendor:adobe acrobat affected >= 9.0, < 9.3.3 fixed 9.3.3
- vendor:opensuse affected >= 11.0, <= 11.2 fixed ?
- vendor:suse linux enterprise affected = 10.0 fixed ?
- vendor:suse linux enterprise affected = 11.0 fixed ?
- vendor:Adobe Flash Player affected ? fixed ?

## How to check

Check whether Adobe Flash Player is installed on any machine or browser (for example, look for FlashPlayer plugin files or the Flash Player entry in installed programs). unknown for any other check.

## Fix

Remove Adobe Flash Player, since the product is end-of-life and CISA says to disconnect it if still in use. unknown for a patched version number.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-1297
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-1297
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-1297

## From the sources

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_