---
id: "CVE-2011-0609"
kind: "vulnerability"
aliases: ["CVE-2011-0609"]
title: "Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris;\u2026"
severity: "critical"
cvss: 9.3
epss: 0.63507
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Adobe Flash Player", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": [], "affected": "<= 10.2.154.13", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": [], "affected": "<= 10.1.106.16", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": [], "affected": ">= 9.0, <= 9.4.2", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": [], "affected": "= 10.0.1", "ecosystem": "vendor"}, {"name": "adobe acrobat reader", "fixed": [], "affected": ">= 9.0, <= 9.4.2", "ecosystem": "vendor"}, {"name": "adobe acrobat reader", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "adobe acrobat reader", "fixed": [], "affected": "= 10.0.1", "ecosystem": "vendor"}, {"name": "adobe air", "fixed": [], "affected": "<= 2.5.1", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.2", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.3", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 11.4", "ecosystem": "vendor"}, {"name": "suse linux enterprise", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "suse linux enterprise", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "google chrome", "fixed": ["10.0.648.134"], "affected": "< 10.0.648.134", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "exploited", "linux", "macos", "runtime", "windows"]
not_affected_if: ["no-flash-installed"]
published_at: "2011-03-15T17:55:03+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-0609", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2011-0609", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0609", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris;…

Adobe Flash Player has an unspecified flaw that lets remote attackers run code or crash the player. The CISA known-exploited catalog lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Flash Player affected ? fixed ?
- vendor:adobe flash player affected <= 10.2.154.13 fixed ?
- vendor:adobe flash player affected <= 10.1.106.16 fixed ?
- vendor:adobe acrobat affected >= 9.0, <= 9.4.2 fixed ?
- vendor:adobe acrobat affected = 10.0 fixed ?
- vendor:adobe acrobat affected = 10.0.1 fixed ?
- vendor:adobe acrobat reader affected >= 9.0, <= 9.4.2 fixed ?
- vendor:adobe acrobat reader affected = 10.0 fixed ?
- vendor:adobe acrobat reader affected = 10.0.1 fixed ?
- vendor:adobe air affected <= 2.5.1 fixed ?
- vendor:opensuse affected = 11.2 fixed ?
- vendor:opensuse affected = 11.3 fixed ?
- vendor:opensuse affected = 11.4 fixed ?
- vendor:suse linux enterprise affected = 10.0 fixed ?
- vendor:suse linux enterprise affected = 11.0 fixed ?
- vendor:google chrome affected < 10.0.648.134 fixed 10.0.648.134

## How to check

Check whether Adobe Flash Player is installed on any machine (for example, look for FlashPlayer plugin files or the Flash Player entry in installed software).

## Fix

Remove Adobe Flash Player from any system still using it, since the product is end-of-life and CISA says to disconnect it if still in use.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-0609
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2011-0609
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2011-0609

## From the sources

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_