CVE-2020-9633 is a critical use-after-free vulnerability affecting Adobe Flash Player Desktop Runtime (32.0.0.371 and earlier), Flash Player for Google Chrome (32.0.0.371 and earlier), and Flash Player for Microsoft Edge and Internet Explorer (32.0.0.330 and earlier). This flaw, rated 9.8 CRITICAL on CVSS, allows for unauthenticated, low-complexity network attacks that could lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. While there are no known public exploits or active exploitation listed in KEV, the vulnerability has garnered significant community discussion and media coverage, indicating its importance. Organizations should prioritize patching affected Adobe Flash Player installations across Windows, macOS, and Linux systems.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 32.0.0.371CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* | ||
<= 32.0.0.371CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 32.0.0.330CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 32.0.0.330CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.