Adobe Flash Player Integer Overflow Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-08
• EPSS: 21% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

CISA: Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 22 Jun 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.org/files/116435/Adobe-Flash-Player-Matrix3D-Integer-Overflow-Code-…ExploitThird Party Advisory
• www.adobe.com/support/security/bulletins/apsb12-19.htmlNot ApplicableVendor Advisory
• www.vupen.com/english/services/ba-index.phpBroken Link
• exchange.xforce.ibmcloud.com/vulnerabilities/78866Third Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource