CVE-2017-3106

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-704

Affected software

Vendor	Product	Versions
Adobe Systems Incorporated	Flash Player	26.0.0.137 and earlier.

References

http://www.securityfocus.com/bid/100190Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039088Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2457Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb17-23.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201709-16Third Party Advisory
https://www.exploit-db.com/exploits/42480/Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/100190Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039088Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2457Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb17-23.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201709-16Third Party Advisory
https://www.exploit-db.com/exploits/42480/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-31077.5Adobe Experience Manager 6.3 and earlier has a misconfiguration vulnerability.CVE-2017-31089.8Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability.CVE-2017-31096.1An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Adobe Experience Manager has a reflected cross-site scripting vulner CVE-2017-31107.5Adobe Experience Manager 6.1 and earlier has a sensitive data exposure vulnerability.CVE-2017-31117.5An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain cir CVE-2017-31129.8An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that r CVE-2017-31138.8Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl CVE-2017-31149.8An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that r CVE-2017-31156.5Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an info CVE-2017-31168.8Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl CVE-2017-31178.8Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an expl CVE-2017-31186.5Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has a secur