CVE-2017-3062 is a critical use-after-free vulnerability in Adobe Flash Player versions 25.0.0.127 and earlier, impacting various platforms including Adobe, Apple, Google, Linux, and Microsoft products. With a CVSS score of 9.8, it presents a severe risk of arbitrary code execution due to its network-based attack vector and low attack complexity. Although not listed in CISA's KEV catalog, the vulnerability has garnered significant community discussion and media coverage, indicating its importance. There is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not currently considered actively exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 25.0.0.127CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 25.0.0.127CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* | ||
<= 25.0.0.127CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 25.0.0.127CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.