CVE-2017-2986 is a critical heap overflow vulnerability in the Flash Video (FLV) codec of Adobe Flash Player versions 24.0.0.194 and earlier, impacting products across Adobe, Apple, Google, Linux, and Microsoft. With a CVSS score of 8.8 (HIGH), it allows for arbitrary code execution through a low-complexity attack requiring user interaction, leading to high confidentiality, integrity, and availability impacts. While not listed on CISA's KEV catalog, exploit code is publicly available via ExploitDB, and it has garnered some community discussion and media coverage, indicating its potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 24.0.0.194CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 24.0.0.194CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 24.0.0.194CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* | ||
<= 24.0.0.194CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.