CVE-2017-2994 is a use-after-free vulnerability in the Primetime SDK event dispatch of Adobe Flash Player versions 24.0.0.194 and earlier, impacting products from Adobe, Apple, Google, Linux, and Microsoft. With a CVSS score of 8.8 (HIGH), it allows for arbitrary code execution via a network-based attack requiring user interaction, posing a significant risk to confidentiality, integrity, and availability. While no public exploit code or Metasploit modules are available, and it's not listed in CISA's KEV catalog, there has been some community discussion and media coverage regarding its patch.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* | ||
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.