CVE-2017-3106
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion...
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2017-3106- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-704
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2017-3106- Updated
- 2026-11-02
EUVDEUVD-2017-12247 No score
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
- Record
EUVD-2017-12247- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fvch-gj67-rr73
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion...
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
- Record
GHSA-fvch-gj67-rr73- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-704
- Updated
- 2026-11-02
OSVRHSA-2017:2457
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2017:2457- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-3106
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
- Record
UBUNTU-CVE-2017-3106- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0314 No score
Updated flash-player-plugin packages fix security vulnerabilities
This update upgrades Flash Player to version 26.0.0.151.
Security Fix(es):
- This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2017-3085, CVE-2017-3106)
- Record
MGASA-2017-0314- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 From an advisory covering 2 CVEs |
before 26.0.0.151-1.1.mga5.nonfree | 26.0.0.151-1.1.mga5.nonfree |
flash-player-pluginMageia:6 From an advisory covering 2 CVEs |
before 26.0.0.151-1.1.mga6.nonfree | 26.0.0.151-1.1.mga6.nonfree |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 2 CVEs |
before 0:26.0.0.151-1.el6_9 | 0:26.0.0.151-1.el6_9 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 26.0.0.151ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 45 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1 |
26.0.0.151ubuntu0.14.04.1 |
flashplugin-nonfreeUbuntu:16.04:LTS |
before 26.0.0.151ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 18 moreShow less11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.1 |
26.0.0.151ubuntu0.16.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Adobe Flash - Invoke Accesses Trait Out-of-Bounds | 2017-08-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-3106 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published August 11, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 22.3%, the 97th percentile. Fixed in flashplugin-nonfree 26.0.0.151ubuntu0.14.04.1.
References
exploit-db.com/exploits/42480
securitytracker.com/id/1039088
securityfocus.com/bid/100190
security.gentoo.org/glsa/201709-16
access.redhat.com/errata/RHSA-2017:2457
helpx.adobe.com/security/products/flash-player/apsb17-23.html
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-3106
github.com/advisories/GHSA-fvch-gj67-rr73
advisories.mageia.org/MGASA-2017-0314.html
bugs.mageia.org/show_bug.cgi?id=21506
bugzilla.redhat.com/show_bug.cgi?id=1479887
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2457.json
cve.org/CVERecord?id=CVE-2017-3085
ubuntu.com/security/CVE-2017-3106
rhn.redhat.com/errata/RHSA-2017-2457.html
Left out here: 7 versions. The JSON record has them.