CVE-2014-0502Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on…
Updated under an hour ago ()
Does this affect you?
It affects adobe flash_player and 11 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Sep 17, 2024; federal agencies had to remediate by Oct 8, 2024. Treat that date as your deadline.
Do this next
Free account, 1 product
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
- CVSS
- 8.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-415
- Known exploited
- Added to CISA KEV Sep 17, 2024; federal remediation due Oct 8, 2024The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- EPSS (exploitation in the next 30 days)
- 24.82% (percentile 98)
- Assigned by
- adobe
- NVD analysis
- Analyzed
- Record last updated
- Oct 22, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
adobe flash_player adobe:flash_player | before 11.7.700.269; from 11.8.0 before 12.0.0.70 | CISA ADP |
adobe air adobe:air | before 4.0.0.1628 | CISA ADP |
adobe air_sdk adobe:air_sdk | before 4.0.0.1628 | CISA ADP |
adobe flash_player adobe:flash_player | before 11.7.700.269; from 11.8.800.94 before 12.0.0.70; before 11.2.202.341 | NVD |
adobe adobe_air_sdk adobe:adobe_air_sdk | before 4.0.0.1628 | NVD |
adobe adobe_air adobe:adobe_air | before 4.0.0.1628 | NVD |
opensuse opensuse opensuse:opensuse | 11.4; 12.3; 13.1 | NVD |
suse linux_enterprise_desktop suse:linux_enterprise_desktop | 11 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 5.0; 6.0 | NVD |
redhat enterprise_linux_eus redhat:enterprise_linux_eus | 6.5 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 5.0; 6.0 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 6.5 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 5.0; 6.0 | NVD |
References
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.htmlvendor-advisory, x-refsource-suse, mailing-list
- https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.htmlx-refsource-misc, exploit, third-party-advisory
- http://security.gentoo.org/glsa/glsa-201405-04.xmlvendor-advisory, x-refsource-gentoo, third-party-advisory
- http://helpx.adobe.com/security/products/flash-player/apsb14-07.htmlx-refsource-confirm, broken-link, patch, vendor-advisory
- http://rhn.redhat.com/errata/RHSA-2014-0196.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.htmlvendor-advisory, x-refsource-suse, mailing-list
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.htmlvendor-advisory, x-refsource-suse, mailing-list
- http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/x-refsource-misc, exploit, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0502us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.