Every CVE Search/ Get API key

CVE-2017-3064

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption...

7.8 HighPublic exploitFix available

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline. Successful exploitation could lead to arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

13.5%Down 17.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline. Successful exploitation could lead to arbitrary code execution.

Record
CVE-2017-3064
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline. Successful exploitation could lead to arbitrary code execution.

Record
CVE-2017-3064
Updated
2026-11-02
EUVDEUVD-2017-12205 No score

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline. Successful exploitation could lead to arbitrary code execution.

Record
EUVD-2017-12205
Updated
2026-11-03
GitHub AdvisoriesGHSA-j87c-997w-jvh4 7.8

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption...

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline. Successful exploitation could lead to arbitrary code execution.

Record
GHSA-j87c-997w-jvh4
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVRHSA-2017:0934 8.8

Red Hat Security Advisory: flash-plugin security update

Record
RHSA-2017:0934
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-3064 7.8

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline. Successful exploitation could lead to arbitrary code execution.

Record
UBUNTU-CVE-2017-3064
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0114 No score

Updated flash-player-plugin package fixes security vulnerability

This update fixes the following critical security issues:

  • use-after-free vulnerabilities that could lead to code execution (CVE-2017-3058, CVE-2017-3059, CVE-2017-3062, CVE-2017-3063).
  • memory corruption vulnerabilities that could lead to code execution (CVE-2017-3060, CVE-2017-3061, CVE-2017-3064).
Record
MGASA-2017-0114
Updated
2026-11-02
OSVSUSE-SU-2017:0990-1 No score

Security update for flash-player

Adobe flash-player was updated to 25.0.0.148 to fix the following issues:

  • Vulnerabilities fixed as advised under APSB17-10:

    • Use-after-free vulnerabilities that could lead to code execution (CVE-2017-3058, CVE-2017-3059, CVE-2017-3062, CVE-2017-3063).
    • Resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-3060, CVE-2017-3061, CVE-2017-3064).

  • Details: https://helpx.adobe.com/security/products/flash-player/apsb17-10.html

Record
SUSE-SU-2017:0990-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flash-player-plugin
Mageia:5
 before 25.0.0.148-1.1.mga5.nonfree
25.0.0.148-1.1.mga5.nonfree
flash-plugin
Red Hat:rhel_extras:6
 before 0:25.0.0.148-1.el6_9
0:25.0.0.148-1.el6_9
flash-player
SUSE:Linux Enterprise Desktop 12 SP1
 before 25.0.0.148-165.1
25.0.0.148-165.1
flash-player
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 25.0.0.148-165.1
25.0.0.148-165.1
flashplugin-nonfree
Ubuntu:14.04:LTS
 before 25.0.0.171ubuntu0.14.04.1, plus listed versions
11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1
Show 45 moreShow less
11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1
25.0.0.171ubuntu0.14.04.1
flashplugin-nonfree
Ubuntu:16.04:LTS
 before 25.0.0.171ubuntu0.16.04.1, plus listed versions
11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1
Show 14 moreShow less
11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.1
25.0.0.171ubuntu0.16.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBAdobe Flash - Out-of-Bounds Read in Getting TextField Width2017-05-17

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-3064 is a high vulnerability (CVSS 7.8) in Adobe Flash Player, published April 12, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.5%, the 96th percentile. Fixed in flash-player-plugin 25.0.0.148-1.1.mga5.nonfree.

References

Show 37 moreShow less
This page doesn't list everything

Left out here: 3 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open