Every CVE Search/ Get API key

CVE-2007-3456

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to...

9.3 HighPublic exploitFix available

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.

Exploit likelihood

47.7%Down 29.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.

Record
CVE-2007-3456
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.

Record
CVE-2007-3456
Updated
2026-11-02
EUVDEUVD-2007-3441 No score

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.

Record
EUVD-2007-3441
Updated
2026-11-03
GitHub AdvisoriesGHSA-9g9c-g893-6m3w No score

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to...

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.

Record
GHSA-9g9c-g893-6m3w
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flash-plugin
Red Hat:rhel_extras:3
 before 0:9.0.48.0-1.el3.with.oss
0:9.0.48.0-1.el3.with.oss
flash-plugin
Red Hat:rhel_extras:4
 before 0:9.0.48.0-1.el4
0:9.0.48.0-1.el4
flash-plugin
Red Hat:rhel_extras:5::client
 before 0:9.0.48.0-1.el5
0:9.0.48.0-1.el5
flash-plugin
Red Hat:rhel_extras:5::server
 before 0:9.0.48.0-1.el5
0:9.0.48.0-1.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBAdobe Flash Player 8.0.24 - '.SWF' File Handling Remote Code Execution2007-07-10

History

History
RecordedChangedSources
aliasesEUVD
affected, aliases, exploits, facts, references, titleExploit-DB, GitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-3456 is a high vulnerability (CVSS 9.3) in Adobe Flash Player, published July 11, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 47.7%, the 98th percentile. Fixed in flash-plugin 0:9.0.48.0-1.el3.with.oss.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open