{"id":"CVE-2017-2926","aliases":["EUVD-2017-12067","GHSA-c49x-6jw2-jchg","MGASA-2017-0014","RHSA-2017:0057","SUSE-SU-2017:0108-1","UBUNTU-CVE-2017-2926"],"status":"published","title":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09905,"percentile":0.9561,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2017-01-11T04:40:00Z","modified":"2026-06-29T10:14:48Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["24.0.0.194ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","fixed_in":["24.0.0.194ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.0.194-1.mga5.nonfree"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.0.0.194-1.el6_8"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.0.194-155.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.0.194-155.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.0.194ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1","11.2.202.616ubuntu0.14.04.1","11.2.202.621ubuntu0.14.04.1","11.2.202.626ubuntu0.14.04.1","11.2.202.632ubuntu0.14.04.1","11.2.202.635ubuntu0.14.04.1","11.2.202.637ubuntu0.14.04.1","11.2.202.643ubuntu0.14.04.1","11.2.202.644ubuntu0.14.04.1","24.0.0.186ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.0.194ubuntu0.16.04.1"}]}],"versions":["11.2.202.540ubuntu2","11.2.202.548ubuntu1","11.2.202.554ubuntu1","11.2.202.559ubuntu1","11.2.202.569ubuntu1","11.2.202.577ubuntu1","11.2.202.616ubuntu1","11.2.202.621ubuntu0.16.04.1","11.2.202.626ubuntu0.16.04.1","11.2.202.632ubuntu0.16.04.1","11.2.202.635ubuntu0.16.04.1","11.2.202.637ubuntu0.16.04.1","11.2.202.643ubuntu0.16.04.1","11.2.202.644ubuntu0.16.04.1","24.0.0.186ubuntu0.16.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"}],"references":[{"url":"https://security.gentoo.org/glsa/201702-20","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-02.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","article","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0057.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1037570","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/95350","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2926","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c49x-6jw2-jchg"},{"url":"https://advisories.mageia.org/MGASA-2017-0014.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19960","tags":["report"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-39.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0057","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1411929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0057.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2925","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2926","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2927","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2928","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2928","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2931","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2932","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2933","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2935","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2936","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2937","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2937","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2938","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170108-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019129","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2938","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-2926","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-2926","description":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-01-11T04:40:00Z","modified":"2024-08-05T14:09:17.762Z","updated_at":"2026-11-02T14:33:15.887816Z"}],"euvd":[{"id":"EUVD-2017-12067","description":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-01-11T04:40:00Z","modified":"2024-08-05T14:09:17Z","updated_at":"2026-11-03T02:39:19.516435Z"}],"ghsa":[{"id":"GHSA-c49x-6jw2-jchg","title":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2022-05-14T03:54:54Z","modified":"2023-01-28T05:00:59Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:43:27.435054Z"}],"nvd":[{"id":"CVE-2017-2926","description":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-01-11T04:59:00.227Z","modified":"2026-06-17T01:17:09.06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:42.372487Z"}],"osv":[{"id":"RHSA-2017:0057","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T13:37:13Z","modified":"2026-06-29T10:14:48Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-2926","description":"Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-01-11T04:59:00Z","modified":"2025-07-16T07:36:38.226896Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2017-0014","title":"Updated flash-player-plugin packages fix security vulnerabilities","description":"Adobe Flash Player 24.0.0.194 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow\nan attacker to take control of the affected system.\n\nAdobe is aware of a report that an exploit for CVE-2016-7892 exists in\nthe wild, and is being used in limited, targeted attacks against users\nrunning Internet Explorer (32-bit) on Windows.\n\nThis update resolves security bypass vulnerabilities (CVE-2016-7890,\nCVE-2017-2938).\n\nThis update resolves use-after-free vulnerabilities that could lead to\ncode execution (CVE-2016-7872, CVE-2016-7877, CVE-2016-7878,\nCVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7892,\nCVE-2017-2932, CVE-2017-2936, CVE-2017-2937). \n\nThis update resolves buffer overflow vulnerabilities that could lead to\ncode execution (CVE-2016-7867, CVE-2016-7868, CVE-2016-7869,\nCVE-2016-7870, CVE-2017-2927, CVE-2017-2933, CVE-2017-2934,\nCVE-2017-2935).\n\nThis update resolves memory corruption vulnerabilities that could lead\nto code execution (CVE-2016-7871, CVE-2016-7873, CVE-2016-7874,\nCVE-2016-7875, CVE-2016-7876, CVE-2017-2925, CVE-2017-2926,\nCVE-2017-2928, CVE-2017-2930, CVE-2017-2931).\n\nNote that Adobe has dropped Adobe Access DRM support from all their\nLinux releases since their 11.2 release series (which no longer gets\nsecurity updates), so any Flash content protected with Adobe Access\nwill no longer work.\n","status":"published","published":"2017-01-13T10:32:16Z","modified":"2026-04-16T06:23:04.169563423Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2017:0108-1","title":"Security update for flash-player","description":"This update to Adobe Flash 24.0.0.194 fixes the following vulnerabilities advised under APSB17-02:\n\n- security bypass vulnerability that could lead to information disclosure (CVE-2017-2938)\n- use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937)\n- heap buffer overflow vulnerabilities that could lead to code execution\n  (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935)\n- memory corruption vulnerabilities that could lead to code execution\n  (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931)\n","status":"published","published":"2017-01-11T16:33:32Z","modified":"2026-02-04T03:37:23.556145Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}