CVE-2019-8070
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use...
CVE-2019-8070 is a critical vulnerability (CVSS 9.8) in Adobe Flash Player, published September 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.92%, the 93rd percentile. Fixed in flash-player-plugin 32.0.0.255-1.mga6.nonfree.
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- Record
CVE-2019-8070- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- Record
CVE-2019-8070- Updated
- 2026-11-02
EUVDEUVD-2019-17528 No score
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- Record
EUVD-2019-17528- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gr5g-6jc7-7vf8 No score
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use...
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- Record
GHSA-gr5g-6jc7-7vf8- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRHSA-2019:2756
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2019:2756- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0273 No score
Updated flash-player-plugin packages fix security vulnerabilities
Updated flash-player-plugin package fixes security vulnerabilities:
Same origin method execution that leads to arbitrary code execution in the context of the current user. (CVE-2019-8069)
Use after free that leads to arbitrary code execution in the context of the current user. (CVE-2019-8070)
- Record
MGASA-2019-0273- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:6 |
before 32.0.0.255-1.mga6.nonfree | 32.0.0.255-1.mga6.nonfree |
flash-player-pluginMageia:7 |
before 32.0.0.255-1.mga7.nonfree | 32.0.0.255-1.mga7.nonfree |
flash-pluginRed Hat:rhel_extras:6 |
before 0:32.0.0.255-1.el6_10 | 0:32.0.0.255-1.el6_10 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
helpx.adobe.com/security/products/flash-player/apsb19-46.html
security.gentoo.org/glsa/201911-05
nvd.nist.gov/vuln/detail/CVE-2019-8070
github.com/advisories/GHSA-gr5g-6jc7-7vf8
advisories.mageia.org/MGASA-2019-0273.html
bugs.mageia.org/show_bug.cgi?id=25429
Show 9 moreShow less
access.redhat.com/errata/RHSA-2019:2756
bugzilla.redhat.com/show_bug.cgi?id=1750958
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2756.json
cve.org/CVERecord?id=CVE-2019-8069