CVE-2010-1297: Adobe Flash Player Memory Corruption Vulnerability

CVSS: 9.3v2.0HighKEVAnalyzed

Published 08-06-2010Last modified 22-10-2025

Vulnerability summary

CVE-2010-1297 is a high (CVSS 9.3) Out-of-bounds Write vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 82.53% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 7 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

82.53%

0%100%

Critical · +0.29 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits7reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 3

RHSA-2010:0464 RHSA-2010:0470 RHSA-2010:0503

Timeline

08-06-2010
PublishedVulnerability first disclosed.
08-06-2022
Added to CISA KEVAdobe Flash Player Memory Corruption Vulnerability
22-06-2022
CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
22-10-2025
Last modifiedVulnerability information updated.

Description

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.8v2.09.3

EPSS trend

Probability

82.53%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.29 pp

From 82.24% on 19-09-2026

19-09-202619-10-2026

EPSS score

82.53%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 08-06-2022
Federal due date: 22-06-2022

CISA required action

The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2010-1297

Public exploits

7 found

referenceUnverified
Exploit Reference (blog.zynamics.com)
Maturity: unknown
exploit-databaseremotemultipleVerified
Adobe Flash / Reader - Live Malware
Maturity: weaponized
exploit-databaselocalwindowsVerified
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (1)
Maturity: weaponized

Show all 7 exploits

exploit-databaselocalwindowsVerified
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (2)
Maturity: weaponized
exploit-databaseremotewindowsVerified
Adobe Acrobat Reader and Flash Player - 'newclass' Invalid Pointer
Maturity: weaponized
MetasploitremoteUnverified
Adobe Flash Player "newfunction" Invalid Pointer Use
exploit/windows/browser/adobe_flashplayer_newfunction
Maturity: poc
MetasploitremoteUnverified
Adobe Flash Player "newfunction" Invalid Pointer Use
exploit/windows/fileformat/adobe_flashplayer_newfunction
Maturity: poc

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Adobe3 products

acrobat≥ 8.0, < 8.2.3 | ≥ 9.0, < 9.3.3
air< 2.0.2.12610
flash_player< 9.0.277.0 | ≥ 10.0, < 10.1.53.64

Opensuse1 product

opensuse≥ 11.0, ≤ 11.2

Suse1 product

linux_enterprise10.0:sp3 | 11.0 | 11.0:sp1

3 vendors · 5 products

References

44 links

www.vupen.com/english/advisories/2010/1636VDB EntryX Refsource VUPENBroken Link
community.websense.com/blogs/…X Refsource MISCBroken Link
www.vupen.com/english/advisories/2010/1349VDB EntryX Refsource VUPENBroken LinkVendor Advisory
www.adobe.com/support/security/bulletins/apsb10-15.htmlX Refsource CONFIRMNot Applicable
www.vupen.com/english/advisories/2011/0192VDB EntryX Refsource VUPENBroken Link
www.vupen.com/english/advisories/2010/1421VDB EntryX Refsource VUPENBroken Link
support.apple.com/kb/HT4435X Refsource CONFIRMBroken Link
secunia.com/advisories/40545Third Party AdvisoryX Refsource SECUNIABroken Link
blog.zynamics.com/2010/…X Refsource MISCExploit
www.redhat.com/support/errata/RHSA-2010-0464.htmlVendor AdvisoryX Refsource REDHATBroken Link

Show all 44 references

www.vupen.com/english/advisories/2010/1793VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/43026Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2010/1432VDB EntryX Refsource VUPENBroken Link
security.gentoo.org/glsa/glsa-201101-09.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.us-cert.gov/cas/techalerts/TA10-162A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.adobe.com/support/security/advisories/apsa10-01.htmlX Refsource CONFIRMVendor Advisory
www.kb.cert.org/vuls/id/486225Third Party AdvisoryX Refsource CERT VNUS Government Resource
lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
www.securityfocus.com/bid/40759VDB EntryX Refsource BIDBroken LinkThird Party Advisory
securitytracker.com/id?1024085VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
securitytracker.com/id?1024057VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
securitytracker.com/id?1024086VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/40034Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.vupen.com/english/advisories/2010/1434VDB EntryX Refsource VUPENBroken Link
www.securityfocus.com/bid/40586VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txtVendor AdvisoryX Refsource TURBOBroken Link
itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751Vendor AdvisoryX Refsource HPBroken Link
lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
securitytracker.com/id?1024058VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.vupen.com/english/advisories/2010/1348VDB EntryX Refsource VUPENBroken LinkVendor Advisory
www.exploit-db.com/exploits/13787ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.adobe.com/support/security/bulletins/apsb10-14.htmlX Refsource CONFIRMNot Applicable
www.us-cert.gov/cas/techalerts/TA10-159A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/40144Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/support/errata/RHSA-2010-0470.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.vupen.com/english/advisories/2010/1482VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/40026Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/59137VDB EntryX Refsource XFThird Party Advisory
www.vupen.com/english/advisories/2010/1522VDB EntryX Refsource VUPENBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7116VDB EntrySignatureX Refsource OVALBroken Link
www.osvdb.org/65141VDB EntryX Refsource OSVDBBroken Link
www.vupen.com/english/advisories/2010/1453VDB EntryX Refsource VUPENBroken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1297Government ResourceUS Government Resource

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities