{"id":"CVE-2014-8439","kind":"vulnerability","aliases":["CVE-2014-8439"],"related":[],"title":"Adobe Flash Player: Adobe Flash Player Dereferenced Pointer Vulnerability","description":"Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.","summary":"Adobe Flash Player mishandles a dereferenced memory pointer, a memory-corruption bug. An attacker who gets a user to load crafted Flash content can run code on the machine.","severity":"critical","cvss":10.0,"epss":0.20369,"exploited":true,"exploited_at":"2022-05-25T00:00:00+00:00","products":[{"name":"Adobe Flash Player","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","exploited","flash-player","linux","macos","runtime","windows"],"not_affected_if":["no-flash-installed"],"how_to_check":"Check whether any machine has Adobe Flash Player installed and what version it runs; the sources do not give a specific command.","fix":"Remove Adobe Flash Player; the product is end-of-life and CISA says to disconnect it if still in use.","status":"open","published_at":"2014-11-25T23:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:34+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:15:34Z","model":"claude-haiku-5-5","output":{"fix":"Remove Adobe Flash Player; the product is end-of-life and CISA says to disconnect it if still in use.\nunknown","reach":"internet","impact":"high","summary":"Adobe Flash Player mishandles a dereferenced memory pointer, a memory-corruption bug. An attacker who gets a user to load crafted Flash content can run code on the machine.","category":"runtime","who_cares":["flash-player","windows","macos","linux","browsers"],"confidence":0.7,"needs_auth":"no","worst_case":"Code runs on the user's machine after opening crafted Flash content.","analyst_note":"Confirm affected and fixed Flash versions from Adobe's advisory for CVE-2014-8439; the sources list them as unknown.","how_to_check":"Check whether any machine has Adobe Flash Player installed and what version it runs; the sources do not give a specific command.","needs_analyst":true,"not_affected_if":["no-flash-installed"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000469,"input_tokens":2835,"output_tokens":370,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2014':11A,14A '-8439':12A,15A '11.2.202.424':78C '13.0.0.258':62C '14':64C '15':67C '15.0.0.239':70C '15.0.0.293':84C '15.0.0.302':89C,96C 'adob':1A,4A,28B,58C,81C,85C,91C 'adobe':16A 'air':82C,86C,92C 'allow':97C 'arbitrari':101C 'attack':42B,98C 'browser':19B 'bug':40B 'caus':104C 'code':54B,102C 'compil':94C 'content':51B 'corrupt':39B 'craft':49B 'cve':10A,13A 'denial':106C 'derefer':111C 'dereferenc':7A,33B 'execut':100C 'exploit':20B 'flash':2A,5A,17A,22B,29B,50B,59C 'flash-play':21B 'get':44B 'invalid':109C 'linux':24B,80C 'load':48B 'machin':57B 'maco':25B 'memori':34B,38B 'memory-corrupt':37B 'mishandl':31B 'os':74C 'player':3A,6A,18A,23B,30B,60C 'pointer':8A,35B,110C 'run':53B 'runtim':26B 'sdk':87C,93C 'servic':108C 'unspecifi':113C 'user':46B 'vector':114C 'via':112C 'vulner':9A 'window':27B,72C 'x':65C,68C,75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-11-25T23:59:00+00:00","kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-8439","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-8439","severity":null,"published_at":"2022-05-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2014-8439","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-8439","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2014-8439","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8439","severity":null,"published_at":"2014-11-25T23:59:00+00:00","modified_at":"2026-06-17T00:16:43+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}