CVE-2020-3757
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and...
CVE-2020-3757 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published February 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. Fixed in flash-player-plugin 32.0.0.330-1.mga7.nonfree.
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2020-3757- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-843
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2020-3757- Updated
- 2026-11-02
EUVDEUVD-2020-25023 No score
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
EUVD-2020-25023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pcc6-9jm9-hfp4 No score
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and...
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
GHSA-pcc6-9jm9-hfp4- Weakness
- CWE-843
- Updated
- 2026-11-02
OSVRHSA-2020:0513
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2020:0513- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0085 No score
Updated flash-player-plugin packages fix security vulnerability
Updated flash-player-plugin package fixes a security vulnerability:
Type confusion that leads to arbitrary code execution in the context of the current user. (CVE-2020-3757)
- Record
MGASA-2020-0085- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:7 |
before 32.0.0.330-1.mga7.nonfree | 32.0.0.330-1.mga7.nonfree |
flash-pluginRed Hat:rhel_extras:6 |
before 0:32.0.0.330-1.el6_10 | 0:32.0.0.330-1.el6_10 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
helpx.adobe.com/security/products/flash-player/apsb20-06.html
access.redhat.com/errata/RHSA-2020:0513
security.gentoo.org/glsa/202003-61
nvd.nist.gov/vuln/detail/CVE-2020-3757
github.com/advisories/GHSA-pcc6-9jm9-hfp4
advisories.mageia.org/MGASA-2020-0085.html