CVE-2019-7090
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome...
CVE-2019-7090 is a medium vulnerability (CVSS 6.5) in Adobe Flash Player Desktop Runtime, published February 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.79%, the 91st percentile. Fixed in flash-player-plugin 32.0.0.142-1.mga6.nonfree.
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
CVE-2019-7090- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
CVE-2019-7090- Updated
- 2026-11-02
EUVDEUVD-2019-16641 No score
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
EUVD-2019-16641- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-49vj-5fcp-ch84 No score
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome...
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
GHSA-49vj-5fcp-ch84- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRHSA-2019:0348
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2019:0348- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0090 No score
Updated flash-player-plugin packages fix security vulnerability
Information disclosure in the context of the current user. (CVE-2019-7090)
- Record
MGASA-2019-0090- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:6 |
before 32.0.0.142-1.mga6.nonfree | 32.0.0.142-1.mga6.nonfree |
flash-pluginRed Hat:rhel_extras:6 |
before 0:32.0.0.142-1.el6_10 | 0:32.0.0.142-1.el6_10 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |