CVE-2017-2927 is a critical heap overflow vulnerability in Adobe Flash Player versions 24.0.0.186 and earlier, specifically when processing Adobe Texture Format files, affecting products from Adobe, Apple, Google, Linux, and Microsoft. This vulnerability carries a high CVSS score of 8.8, indicating it can be exploited remotely with low complexity, requiring user interaction, and potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation (not in KEV) and no public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered significant community discussion and media coverage, suggesting awareness of its potential. This vulnerability is considered inactive on the Hot List.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 24.0.0.186CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 24.0.0.186CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 24.0.0.186CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* | ||
<= 24.0.0.186CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.