CVE-2010-1297

HIGH(7.8)KEVLikely Exploited

Adobe Flash Player Memory Corruption Vulnerability

Description

CVE-2010-1297 is a memory corruption vulnerability in Adobe Flash Player that allows remote attackers to execute arbitrary code or cause a denial of service. The flaw is triggered when Flash Player processes specially crafted SWF content, corrupting memory in a way that enables an attacker to redirect program execution. This vulnerability was actively exploited in the wild through both web-based attacks and Flash content embedded in PDF documents delivered via email. CISA has added CVE-2010-1297 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.0% (99th percentile), it has one of the highest exploitation probabilities among known vulnerabilities.

KEV Information

Vendor
Adobe
Product
Flash Player
Date Added
June 8, 2022
Due Date
June 22, 2022
Required Action
The impacted product is end-of-life and should be disconnected if still in use.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9

CWEs

CWE-787Out-of-bounds Write

Out-of-bounds Write

Affected Products

VendorProductVersion
adobeair< 2.0.2.12610
adobeflash player< 9.0.277.0; >= 10.0, < 10.1.53.64
adobeacrobat>= 8.0, < 8.2.3; >= 9.0, < 9.3.3
opensuseopensuse>= 11.0, <= 11.2
suselinux enterprise10.0; 11.0

Multiple CVSS Assessments

Source: [email protected](Primary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1297 exploits a memory corruption condition in Adobe Flash Player where the runtime fails to properly restrict memory operations within buffer boundaries when processing SWF content. This allows crafted Flash content to corrupt adjacent memory and enable arbitrary code execution through controlled memory manipulation.

Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact Analysis

CVE-2010-1297 is remotely exploitable through multiple attack vectors — malicious SWF content can be served via web pages, embedded in PDF documents, or delivered through advertising networks. No authentication is required, and user interaction is minimal. Successful exploitation results in arbitrary code execution with the privileges of the Flash Player process, which typically runs with the current user's permissions. This places confidentiality, integrity, and availability at full risk. The dual attack vector through both web pages and PDF documents significantly expands the attack surface, as PDF documents are commonly exchanged in business environments. The EPSS score of 93.0% (99th percentile) indicates near-certain exploitation. Adobe Flash Player is end-of-life and receives no further security updates.

Exploit Maturity

CISA has confirmed active exploitation of CVE-2010-1297 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 8, 2022. The EPSS score of 93.0% places this vulnerability in the 99th percentile, indicating near-certain exploitation activity. CVE-2010-1297 was exploited as a zero-day in targeted attacks, with malicious Flash content delivered both through web pages and embedded in PDF documents sent via email. The dual delivery mechanism made it particularly effective for both mass exploitation and targeted campaigns. Adobe Flash Player reached end-of-life on December 31, 2020, and the CISA required action states that the product should be disconnected if still in use.

Remediation

  1. Remove Adobe Flash Player entirely: Flash Player is end-of-life and should be completely uninstalled from all systems, as directed by the CISA required action.
  2. Block Flash content at all delivery points: Configure email gateways to strip SWF content from emails and attachments (including PDF files with embedded Flash), and block SWF files at web proxies and firewalls.
  3. Disable Flash content in PDF readers: Configure Adobe Reader and other PDF viewers to block the execution of embedded Flash content within PDF documents.
  4. Audit for residual Flash Player installations: Conduct enterprise-wide scanning to identify any remaining Flash Player installations, browser plugins, or applications with embedded Flash components.
  5. Deploy network-level SWF detection: Implement deep content inspection at network security appliances to detect and block SWF content delivery, regardless of the transport mechanism (HTTP, SMTP, or embedded in other file formats).

Technical Details

CVE-2010-1297 is a memory corruption vulnerability in Adobe Flash Player triggered during the processing of specially crafted SWF content. The vulnerability occurs when the Flash Player runtime performs memory operations that exceed buffer boundaries, classified under CWE-119, allowing an attacker to corrupt adjacent memory structures and redirect execution. A notable aspect of this vulnerability is its exploitation through multiple delivery vectors: directly via malicious web pages containing SWF objects, and indirectly through Flash content embedded within PDF documents. When Flash content is embedded in a PDF, opening the document in Adobe Reader automatically invokes Flash Player to render the SWF, creating an indirect attack path that may bypass security controls focused solely on web-based Flash content.

Frequently Asked Questions

Is CVE-2010-1297 being actively exploited?

Yes. CISA has confirmed active exploitation by adding CVE-2010-1297 to the Known Exploited Vulnerabilities catalog. The EPSS score of 93.0% in the 99th percentile indicates near-certain exploitation. The vulnerability was exploited as a zero-day through both web pages and Flash content embedded in PDF documents.

What products are affected by CVE-2010-1297?

CVE-2010-1297 affects Adobe Flash Player, which reached end-of-life on December 31, 2020. The vulnerability can also be triggered through Flash content embedded in PDF documents opened in Adobe Reader.

How do I fix CVE-2010-1297?

Completely remove Adobe Flash Player from all systems. Block Flash content at email gateways, web proxies, and firewalls. Disable Flash content rendering in PDF readers to eliminate the document-based attack vector.

How severe is CVE-2010-1297?

CVE-2010-1297 is a critically severe memory corruption vulnerability with an EPSS score in the 99th percentile. The dual attack vector through web pages and PDF documents, combined with the end-of-life status of Flash Player, makes this vulnerability exceptionally dangerous for any systems with residual Flash installations.

CVSS Score

7.8
HIGH(7.8)

EPSS Score

EPSS Score82.36%
EPSS Percentile99.6%

Dates

PublishedJune 8, 2010
Last ModifiedJune 16, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch