CVE-2012-5054

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before...

8.8 HighIn KEVFix available

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

21.2%Up 14.9 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

Record: CVE-2012-5054
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-190
Updated: 2026-11-02

CVE List 8.8

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

Record: CVE-2012-5054
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2012-4978 8.8

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

Record: EUVD-2012-4978
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xxxm-q6xf-58pf 8.8

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before...

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

Record: GHSA-xxxm-q6xf-58pf
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

CISA KEV No score

Adobe Flash Player Integer Overflow Vulnerability

Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.

Record: CVE-2012-5054
Weakness: CWE-189
Updated: 2026-11-02

Affected products

adobe flash player

Affected packages

Affected packages
Package	Affected	Fixed
`flash-plugin` Red Hat:rhel_extras:6	before 0:11.2.202.238-1.el6	0:11.2.202.238-1.el6
`flash-plugin` Red Hat:rhel_extras:5::client	before 0:11.2.202.238-1.el5	0:11.2.202.238-1.el5
`flash-plugin` Red Hat:rhel_extras:5::server	before 0:11.2.202.238-1.el5	0:11.2.202.238-1.el5

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5054 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published September 24, 2012. CISA lists it as known to be exploited, since June 8, 2022. EUVD reports exploitation since June 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 21.2%, the 97th percentile. Fixed in flash-plugin 0:11.2.202.238-1.el6.

References

Show 35 moreShow less