CVE-2017-3001 is a critical use-after-free vulnerability in Adobe Flash Player versions 24.0.0.221 and earlier, stemming from a flaw in the ActionScript 2 VM's garbage collection. This vulnerability affects a wide range of products, including those from Adobe, Apple, Google, Linux, and Microsoft. With a CVSS score of 8.8 (High), successful exploitation, which requires user interaction, could lead to arbitrary code execution, resulting in high impact to confidentiality, integrity, and availability. While not listed in CISA's KEV catalog and lacking public exploit code in Metasploit, Nuclei, or ExploitDB, it has garnered some community discussion and media coverage, indicating awareness of its potential risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* | ||
<= 24.0.0.221CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.