CVE-2020-9633
Adobe Flash Player versions 32.0.0.371 and earlier, 32.0.0.371 and earlier, and 32.0.0.330 and...
CVE-2020-9633 is a critical vulnerability (CVSS 9.8) in Adobe Flash Player, published June 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.75%, the 94th percentile. Fixed in flash-player-plugin 32.0.0.387-1.mga7.nonfree.
Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2020-9633- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2020-9633- Updated
- 2026-11-02
EUVDEUVD-2020-30419 No score
Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
EUVD-2020-30419- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hfp4-4377-7cc7 No score
Adobe Flash Player versions 32.0.0.371 and earlier, 32.0.0.371 and earlier, and 32.0.0.330 and...
Adobe Flash Player versions 32.0.0.371 and earlier, 32.0.0.371 and earlier, and 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
GHSA-hfp4-4377-7cc7- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRHSA-2020:2547
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2020:2547- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-9633
Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
UBUNTU-CVE-2020-9633- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0264 No score
Updated flash-player-plugin packages fix security vulnerability
The updated packages fix a security vulnerability: Use after free that leads to arbitrary code execution in the context of the current user. (CVE-2020-9633)
- Record
MGASA-2020-0264- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:7 |
before 32.0.0.387-1.mga7.nonfree | 32.0.0.387-1.mga7.nonfree |
flash-pluginRed Hat:rhel_extras:6 |
before 0:32.0.0.387-1.el6_10 | 0:32.0.0.387-1.el6_10 |
flashplugin-nonfreeUbuntu:16.04:LTS |
before 32.0.0.387ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 45 moreShow less11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.128.0.0.161ubuntu0.16.04.129.0.0.113ubuntu0.16.04.129.0.0.140ubuntu0.16.04.129.0.0.171ubuntu0.16.04.130.0.0.113ubuntu0.16.04.130.0.0.134ubuntu0.16.04.130.0.0.154ubuntu0.16.04.131.0.0.108ubuntu0.16.04.131.0.0.122ubuntu0.16.04.131.0.0.148ubuntu0.16.04.131.0.0.153ubuntu0.16.04.132.0.0.101ubuntu0.16.04.132.0.0.114ubuntu0.16.04.132.0.0.142ubuntu0.16.04.132.0.0.156ubuntu0.16.04.132.0.0.171ubuntu0.16.04.132.0.0.192ubuntu0.16.04.132.0.0.207ubuntu0.16.04.132.0.0.223ubuntu0.16.04.1 |
32.0.0.387ubuntu0.16.04.1 |
flashplugin-nonfreeUbuntu:18.04:LTS |
before 32.0.0.387ubuntu0.18.04.1, plus listed versions 27.0.0.170ubuntu127.0.0.187ubuntu128.0.0.126ubuntu128.0.0.137ubuntu128.0.0.161ubuntu1 Show 30 moreShow less28.0.0.161ubuntu228.0.0.161ubuntu329.0.0.113ubuntu129.0.0.140ubuntu129.0.0.171ubuntu130.0.0.113ubuntu0.18.04.130.0.0.134ubuntu0.18.04.130.0.0.154ubuntu0.18.04.131.0.0.108ubuntu0.18.04.131.0.0.122ubuntu0.18.04.131.0.0.148ubuntu0.18.04.131.0.0.153ubuntu0.18.04.132.0.0.101ubuntu0.18.04.132.0.0.114ubuntu0.18.04.132.0.0.142ubuntu0.18.04.132.0.0.156ubuntu0.18.04.132.0.0.171ubuntu0.18.04.132.0.0.192ubuntu0.18.04.132.0.0.207ubuntu0.18.04.132.0.0.223ubuntu0.18.04.132.0.0.238ubuntu0.18.04.132.0.0.255ubuntu0.18.04.132.0.0.270ubuntu0.18.04.132.0.0.293ubuntu0.18.04.132.0.0.303ubuntu0.18.04.232.0.0.314ubuntu0.18.04.132.0.0.330ubuntu0.18.04.132.0.0.344ubuntu0.18.04.132.0.0.363ubuntu0.18.04.132.0.0.371ubuntu0.18.04.1 |
32.0.0.387ubuntu0.18.04.1 |
flashplugin-nonfreeUbuntu:20.04:LTS |
before 32.0.0.387ubuntu0.20.04.1, plus listed versions 32.0.0.255ubuntu132.0.0.293ubuntu132.0.0.303ubuntu132.0.0.303ubuntu232.0.0.314ubuntu1 Show 5 moreShow less32.0.0.330ubuntu132.0.0.344ubuntu132.0.0.344ubuntu232.0.0.363ubuntu132.0.0.371ubuntu0.20.04.1 |
32.0.0.387ubuntu0.20.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
helpx.adobe.com/security/products/flash-player/apsb20-30.html
security.gentoo.org/glsa/202006-09
nvd.nist.gov/vuln/detail/CVE-2020-9633
github.com/advisories/GHSA-hfp4-4377-7cc7
advisories.mageia.org/MGASA-2020-0264.html
bugs.mageia.org/show_bug.cgi?id=26779
Show 7 moreShow less
access.redhat.com/errata/RHSA-2020:2547
bugzilla.redhat.com/show_bug.cgi?id=1845700
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2547.json
cve.org/CVERecord?id=CVE-2020-9633
ubuntu.com/security/CVE-2020-9633
Left out here: 10 versions. The JSON record has them.