CVE-2017-11292

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

VendorProductVersions
n/aAdobe Flash Player version 27.0.0.159 and earlierAdobe Flash Player version 27.0.0.159 and earlier

References

Timeline

Published
Oct 22, 2017
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 3, 2022
NVD status
Analyzed

Related CVEs from 2017

CVE-2017-112939.8An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.3035CVE-2017-112949.8An issue was discovered in Adobe Shockwave 12.2.9.199 and earlier. An exploitable memory corruption vulnerability exists. Successful exploitCVE-2017-112959.8An issue was discovered in Adobe DNG Converter 9.12.1 and earlier versions. An exploitable memory corruption vulnerability exists. SuccessfuCVE-2017-112966.1An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. A cross-site scripting vulnerability in Apache Sling Servlets Post 2CVE-2017-112975.3An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which cCVE-2017-112985.3An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which cCVE-2017-112995.3An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which cCVE-2017-11306.5IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file CVE-2017-113005.3An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which cCVE-2017-113015.3An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which cCVE-2017-113029.8An issue was discovered in Adobe InDesign 12.1.0 and earlier versions. An exploitable memory corruption vulnerability exists. Successful expCVE-2017-113039.8An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. An exploitable memory corruption vulnerability exists. Su
CVE-2017-11292: High severity, CVSS 8.8 | Vulnix