Skip to content
COOEY

FAIL › dossier

Flash Player

PRODUCT

· dossier confidence 40%

Adobe Flash Player was a discontinued multimedia platform that delivered rich web content but suffered from a relentless stream of critical and high-severity remote code execution vulnerabilities. Its end-of-life status in December 2020 means no security patches are issued, making any remaining installations a perpetual security liability.

Failure events
34
Zero-days
0
RCEs
30
On KEV
33
Critical
4
Worst shame
95
PROFILE
CategorysoftwareWhat they doAdobe Flash Player was a multimedia software platform used to play SWF files, run interactive content, and deliver rich media experiences across browsers and devices.Founded1996 Websitehttps://www.adobe.com/products/flashplayer.html ↗
SECURITY POSTURE

Extremely poor; the product reached end-of-life in December 2020 with no further security updates, leaving all installed instances perpetually vulnerable to unpatched exploits.

Notable failures
  • CVE-2016-1019 critical RCE
  • CVE-2015-7645 critical RCE
  • CVE-2018-4878 critical RCE
  • CVE-2013-0648 high RCE
  • CVE-2014-0497 high RCE
  • CVE-2013-0643 high RCE
Patterns: repeated unpatched RCE via SWF content; use-after-free and memory corruption RCEs; integer overflow and buffer overflow RCEs; XSS and sandbox bypass RCEs
FAILURE HISTORY · 34
DATEEVENTSEVSUMMARY
2022-03-03 CVE-2015-7645 critical Adobe Flash Player vulnerabilities allowed attackers to execute arbitrary code via malicious SWF files, and no patches are available due to the product's end-of-life status.
2022-03-03 CVE-2016-1019 critical Adobe Flash Player, now defunct, contained a critical, actively exploited remote code execution vulnerability, leaving systems perpetually exposed to attack.
2021-11-03 CVE-2018-4878 critical Adobe Flash Player's use-after-free vulnerability allows for code execution and is actively exploited, despite the product's end-of-life status and lack of updates.
2024-09-17 CVE-2014-0502 high Adobe Flash Player's unpatched double-free RCE vulnerability (CVE-2014-0502) remains exploitable due to the product's EOL status.
2024-09-17 CVE-2013-0648 high Adobe Flash Player's unpatched EOL status leaves remote code execution vulnerabilities perpetually exploitable.
2024-09-17 CVE-2014-0497 high Adobe Flash Player's integer underflow vulnerability enabled remote code execution and is actively exploited, posing a critical risk to legacy systems still in use.
2024-09-17 CVE-2013-0643 high Adobe Flash Player's discontinued status leaves unpatched RCE vulnerabilities exploitable in legacy systems.
2022-06-08 CVE-2010-1297 high Adobe Flash Player's unpatched memory corruption vulnerability allowed remote attackers to execute code, a critical flaw in an end-of-life product that remains a perpetual security liability.
2022-05-23 CVE-2018-5002 high Adobe Flash Player's unpatched stack-based buffer overflow allowed remote code execution, proving that end-of-life software remains a perpetual liability.
2022-04-13 CVE-2014-9163 high Adobe Flash Player's unpatched stack-based buffer overflow allowed remote code execution, proving that end-of-life software remains a perpetual liability.
2022-04-13 CVE-2015-5123 high Adobe Flash Player's use-after-free vulnerability allowed remote attackers to execute arbitrary code, and the product's end-of-life status left it perpetually unpatched.
2022-04-13 CVE-2015-0313 high Adobe Flash Player's use-after-free vulnerability allowed remote attackers to execute arbitrary code, a flaw that persisted after the product's end-of-life in 2020.
2022-04-13 CVE-2015-0311 high Adobe Flash Player's unpatched RCE vulnerability remains a perpetual liability after its December 2020 end-of-life.
2022-03-25 CVE-2016-4171 high Adobe Flash Player's end-of-life status left unpatched RCE vulnerabilities perpetually exploitable, exemplifying the catastrophic risk of shipping and maintaining obsolete software.
2022-03-03 CVE-2011-0611 high Adobe Flash Player's unpatched remote code execution vulnerability (CVE-2011-0611) remains actively exploited in the wild despite the product's end-of-life in 2020.
2022-03-03 CVE-2012-1535 high Adobe Flash Player's unpatched arbitrary code execution vulnerability remains a perpetual liability after its December 2020 end-of-life.
2022-03-03 CVE-2015-3043 high Adobe Flash Player's unpatched memory corruption flaw allowed remote code execution, proving that end-of-life software remains a perpetual security liability.
2022-03-03 CVE-2016-4117 high Adobe Flash Player's end-of-life status left unpatched RCE vulnerabilities perpetually exploitable, exemplifying the catastrophic risk of shipping and maintaining obsolete software.
2022-02-15 CVE-2018-15982 critical Adobe Flash Player, now end-of-life, contained a critical use-after-free vulnerability actively exploited by ransomware actors, leaving systems perpetually exposed.
2022-05-25 CVE-2015-8651 high Adobe Flash Player's integer overflow vulnerability allowed remote code execution, and the product's end-of-life status left it perpetually unpatched and exploitable.
2022-04-13 CVE-2015-3113 high Adobe Flash Player's unpatched heap-based buffer overflow allowed remote attackers to execute code, proving that end-of-life software remains a perpetual security liability.
2022-04-13 CVE-2015-5122 high Adobe Flash Player's use-after-free vulnerability allowed remote attackers to execute arbitrary code, and the product's end-of-life status meant it remained perpetually unpatched and exploitable.
2022-03-25 CVE-2016-7892 high An unpatched use-after-free vulnerability in Adobe Flash Player allowed remote code execution, exploited in the wild after Flash reached end-of-life in 2020.
2022-03-03 CVE-2017-11292 high Adobe Flash Player's unpatched type confusion vulnerability allowed remote code execution, proving that end-of-life software remains a perpetual security liability.
2022-03-03 CVE-2016-7855 high Adobe Flash Player's use-after-free vulnerability allowed remote attackers to execute arbitrary code, and the product's end-of-life status left it perpetually unpatched.
2022-03-03 CVE-2015-5119 high Adobe Flash Player's use-after-free vulnerability allowed remote code execution, and the product's end-of-life status meant it remained perpetually unpatched and exploitable.
2022-05-25 CVE-2015-0310 high Adobe Flash Player's ASLR bypass vulnerability allowed attackers to bypass memory randomization protections, enabling remote code execution.
2022-06-08 CVE-2012-0767 high Adobe Flash Player, now end-of-life, contains a cross-site scripting vulnerability actively exploited in the wild, posing a significant risk to systems still running it despite its discontinuation and lack of updates.
2022-06-08 CVE-2011-0609 high Adobe Flash Player, now end-of-life, contained an unspecified vulnerability allowing remote code execution and denial-of-service attacks, and is actively exploited in the wild.
2022-05-25 CVE-2014-8439 high Adobe Flash Player's dereferenced pointer vulnerability allowed remote code execution, exploited in the wild despite the product's end-of-life status.
2022-03-28 CVE-2012-2034 high Adobe Flash Player's unpatched memory corruption flaw allowed remote code execution and was actively exploited in the wild.
2022-06-08 CVE-2012-0754 high Adobe Flash Player's memory corruption vulnerability (CVE-2012-0754) allows for remote code execution and remains unpatched due to the product's end-of-life status.
2022-06-08 CVE-2012-5054 high An integer overflow in Adobe Flash Player allowed remote code execution, and its end-of-life status means no patches exist for this vulnerability.
2016-04-07 CVE-2016-1019 critical CVE-2016-1019: Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a den
DOSSIER SOURCES
Open questions: Exact founding year of Adobe Flash Player · Exact headquarters location of Adobe Flash Player development
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-15 04:08:25.784698+00:00