{"id":"CVE-2011-0609","kind":"vulnerability","aliases":["CVE-2011-0609"],"related":[],"title":"Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris;…","description":"Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.","summary":"Adobe Flash Player has an unspecified flaw that lets remote attackers run code or crash the player. The CISA known-exploited catalog lists it as actively exploited.","severity":"critical","cvss":9.3,"epss":0.63507,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Adobe Flash Player","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe flash player","fixed":[],"affected":"<= 10.2.154.13","ecosystem":"vendor"},{"name":"adobe flash player","fixed":[],"affected":"<= 10.1.106.16","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":[],"affected":">= 9.0, <= 9.4.2","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":[],"affected":"= 10.0.1","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":[],"affected":">= 9.0, <= 9.4.2","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"adobe acrobat reader","fixed":[],"affected":"= 10.0.1","ecosystem":"vendor"},{"name":"adobe air","fixed":[],"affected":"<= 2.5.1","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.2","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.3","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.4","ecosystem":"vendor"},{"name":"suse linux enterprise","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"suse linux enterprise","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"google chrome","fixed":["10.0.648.134"],"affected":"< 10.0.648.134","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","exploited","linux","macos","runtime","windows"],"not_affected_if":["no-flash-installed"],"how_to_check":"Check whether Adobe Flash Player is installed on any machine (for example, look for FlashPlayer plugin files or the Flash Player entry in installed software).","fix":"Remove Adobe Flash Player from any system still using it, since the product is end-of-life and CISA says to disconnect it if still in use.","status":"open","published_at":"2011-03-15T17:55:03+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:44+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:12:44Z","model":"claude-haiku-5-5","output":{"fix":"Remove Adobe Flash Player from any system still using it, since the product is end-of-life and CISA says to disconnect it if still in use.\nunknown","reach":"internet","impact":"high","summary":"Adobe Flash Player has an unspecified flaw that lets remote attackers run code or crash the player. The CISA known-exploited catalog lists it as actively exploited.","category":"runtime","who_cares":["windows","macos","linux","browsers"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs code on the machine through a crafted Flash content.","analyst_note":"Confirm the affected and fixed Flash Player versions and whether the attack needs the victim to open crafted content, using the Adobe security bulletin for CVE-2011-0609 (not in sources).","how_to_check":"Check whether Adobe Flash Player is installed on any machine (for example, look for FlashPlayer plugin files or the Flash Player entry in installed software).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-flash-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000491,"input_tokens":2835,"output_tokens":414,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0609':20A,23A '-2011':19A,22A '10':136C '10.0.1':139C '10.1.106.16':112C '10.2.154.13':7A,101C '2.5.1':119C '2011':184C '9':131C '9.4.2':134C 'acrobat':34A,36A,38A,40A,43A,46A,130C 'activ':93B 'adob':4A,67B,98C,117C,127C 'adobe':24A,27A,30A,33A,35A,37A,39A,42A,45A,48A 'air':49A,118C 'aka':124C 'allow':146C 'android':116C 'applic':159C 'arbitrari':151C 'attack':77B,148C 'authplay.dll':123C 'authplaylib.bundle':125C 'browser':61B 'catalog':89B 'caus':154C 'chrome':60A 'cisa':85B 'code':79B,152C 'content':164C 'craft':162C 'crash':81B,160C 'cve':18A,21A 'demonstr':166C 'denial':156C 'earlier':9A,103C,114C,121C 'embed':171C 'enterprise':55A,58A 'excel':174C 'execut':150C 'exploit':62B,88B,94B,178C 'file':170C 'flash':5A,25A,28A,31A,68B,99C,163C 'flaw':73B 'google':59A 'known':87B 'known-exploit':86B 'let':75B 'linux':15A,54A,57A,63B,109C 'list':90B 'mac':12A,106C,143C 'maco':64B 'march':183C 'opensuse':50A,51A,52A 'os':13A,107C,144C 'player':6A,26A,29A,32A,69B,83B,100C 'reader':41A,44A,47A,128C 'remot':76B,147C 'run':78B 'runtim':65B 'servic':158C 'solari':17A,111C 'spreadsheet':175C 'suse':53A,56A 'swf':169C 'unspecifi':1A,72B,95C 'via':161C 'vulner':2A,96C 'wild':181C 'window':11A,66B,105C,141C 'x':14A,108C,132C,137C,145C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2011-03-15T17:55:03+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2011-0609","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-0609","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2011-0609","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-0609","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2011-0609","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0609","severity":null,"published_at":"2011-03-15T17:55:03+00:00","modified_at":"2026-06-16T23:27:44+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}