{"id":"CVE-2014-0497","kind":"vulnerability","aliases":["CVE-2014-0497"],"related":[],"title":"Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows…","description":"Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.\n\nCISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","summary":"Adobe Flash Player has an integer underflow flaw that lets a remote attacker run arbitrary code. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-09-17T00:00:00+00:00","products":[{"name":"adobe flash player","fixed":["11.2.202.336"],"affected":"< 11.2.202.336","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["11.7.700.261"],"affected":"< 11.7.700.261","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["12.0.0.44"],"affected":">= 11.8.800.94, < 12.0.0.44","ecosystem":"vendor"},{"name":"google chrome","fixed":["32.0.1700.107"],"affected":"< 32.0.1700.107","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 6.5","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 6.5","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.4","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 12.3","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 13.1","ecosystem":"vendor"},{"name":"suse linux enterprise desktop","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"Adobe Flash Player","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-flash-player","browsers","exploited","macos","other","windows"],"not_affected_if":["no-flash-installed"],"how_to_check":"Check whether any machine has Adobe Flash Player installed (unknown for exact path or version in the sources).","fix":"Remove Adobe Flash Player; the product is end-of-life and no longer receives fixes, per CISA.","status":"open","published_at":"2014-02-05T05:15:29+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:08+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:58:08Z","model":"claude-haiku-5-5","output":{"fix":"Remove Adobe Flash Player; the product is end-of-life and no longer receives fixes, per CISA.","reach":"internet","impact":"high","summary":"Adobe Flash Player has an integer underflow flaw that lets a remote attacker run arbitrary code. CISA lists it as actively exploited in the wild.","category":"other","who_cares":["adobe-flash-player","browsers","windows","macos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the victim's machine via crafted content.","analyst_note":"","how_to_check":"Check whether any machine has Adobe Flash Player installed (unknown for exact path or version in the sources).","needs_analyst":false,"not_affected_if":["no-flash-installed"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000437,"input_tokens":2812,"output_tokens":311,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0497':21A,24A '-2014':20A,23A '11.7.700.261':8A '11.8':10A '12.0':13A '12.0.0.44':16A 'action':132C 'activ':108B 'adob':4A,80B,88B,113C 'adobe':25A,28A,31A,76A 'adobe-flash-play':79B 'allow':122C 'and/or':142C 'arbitrari':102B,128C 'attack':100B,125C 'aus':60A 'browser':83B 'chrome':35A 'cisa':104B,130C 'code':103B,129C 'contain':116C 'cve':19A,22A 'desktop':39A,43A,75A 'discontinu':150C 'end':138C,144C 'end-of-lif':137C 'end-of-servic':143C 'enterprise':37A,41A,45A,49A,53A,57A,62A,66A,74A 'eo':147C 'eol':141C 'eus':47A 'execut':127C 'exploit':84B,109B 'flash':5A,26A,29A,32A,77A,81B,89B,114C 'flaw':95B 'google':34A 'impact':134C 'integ':1A,93B,118C 'let':97B 'life':140C 'linux':38A,42A,46A,50A,54A,58A,63A,67A,73A 'list':105B 'maco':85B 'opensuse':69A,70A,71A 'player':6A,27A,30A,33A,78A,82B,90B,115C 'product':135C,154C 'redhat':36A,40A,44A,48A,52A,56A,61A,65A 'remot':99B,124C 'requir':131C 'run':101B 'server':51A,55A,59A 'servic':146C 'suse':72A 'underflow':2A,94B,119C 'user':148C 'util':151C 'vulner':120C 'wild':112B 'window':18A,87B 'workstation':64A,68A 'x':11A,14A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-02-05T05:15:29+00:00","kev":{"dateAdded":"2024-09-17","dueDate":"2024-10-08","requiredAction":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-0497","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497","severity":null,"published_at":"2024-09-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2014-0497","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0497","severity":null,"published_at":"2014-02-05T05:15:29+00:00","modified_at":"2026-06-17T00:03:09+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}