{"id":"CVE-2017-3099","aliases":["EUVD-2017-12240","GHSA-9ww6-3m5v-h28h","MGASA-2017-0211","RHSA-2017:1731","UBUNTU-CVE-2017-3099"],"status":"published","title":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09647,"percentile":0.95523,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2017-07-14T05:00:00Z","modified":"2026-06-29T10:16:53Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["26.0.0.137ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","fixed_in":["26.0.0.137ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137-1.mga5.nonfree"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137-1.1.mga6.nonfree"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.0.0.137-1.el6_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1","11.2.202.616ubuntu0.14.04.1","11.2.202.621ubuntu0.14.04.1","11.2.202.626ubuntu0.14.04.1","11.2.202.632ubuntu0.14.04.1","11.2.202.635ubuntu0.14.04.1","11.2.202.637ubuntu0.14.04.1","11.2.202.643ubuntu0.14.04.1","11.2.202.644ubuntu0.14.04.1","24.0.0.186ubuntu0.14.04.1","24.0.0.194ubuntu0.14.04.1","24.0.0.221ubuntu0.14.04.1","25.0.0.127ubuntu0.14.04.1","25.0.0.148ubuntu0.14.04.1","25.0.0.171ubuntu0.14.04.1","26.0.0.126ubuntu0.14.04.1","26.0.0.131ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137ubuntu0.16.04.1"}]}],"versions":["11.2.202.540ubuntu2","11.2.202.548ubuntu1","11.2.202.554ubuntu1","11.2.202.559ubuntu1","11.2.202.569ubuntu1","11.2.202.577ubuntu1","11.2.202.616ubuntu1","11.2.202.621ubuntu0.16.04.1","11.2.202.626ubuntu0.16.04.1","11.2.202.632ubuntu0.16.04.1","11.2.202.635ubuntu0.16.04.1","11.2.202.637ubuntu0.16.04.1","11.2.202.643ubuntu0.16.04.1","11.2.202.644ubuntu0.16.04.1","24.0.0.186ubuntu0.16.04.1","24.0.0.194ubuntu0.16.04.1","24.0.0.221ubuntu0.16.04.1","25.0.0.127ubuntu0.16.04.1","25.0.0.148ubuntu0.16.04.1","25.0.0.171ubuntu0.16.04.1","26.0.0.126ubuntu0.16.04.1","26.0.0.131ubuntu0.16.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_desktop_runtime"}],"references":[{"url":"http://www.securityfocus.com/bid/99520","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038845","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1731","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-21.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","web","article","report"]},{"url":"https://security.gentoo.org/glsa/201707-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3099","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9ww6-3m5v-h28h"},{"url":"https://advisories.mageia.org/MGASA-2017-0211.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21224","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469763","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1731.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3080","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3099","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3100","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-3099","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-3099","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-07-14T05:00:00Z","modified":"2024-08-05T14:16:27.815Z","updated_at":"2026-11-02T14:33:16.232024Z"}],"euvd":[{"id":"EUVD-2017-12240","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-07-14T05:00:00Z","modified":"2024-08-05T14:16:27Z","updated_at":"2026-11-03T02:39:19.04602Z"}],"ghsa":[{"id":"GHSA-9ww6-3m5v-h28h","title":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2022-05-13T01:04:51Z","modified":"2023-01-30T15:30:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:47:50.107277Z"}],"nvd":[{"id":"CVE-2017-3099","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-07-17T13:18:26.14Z","modified":"2026-06-17T01:17:30.713Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"RHSA-2017:1731","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T13:38:44Z","modified":"2026-06-29T10:16:53Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-3099","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-07-17T13:18:00Z","modified":"2025-07-16T07:36:39.771385Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2017-0211","title":"Updated flash-player-plugin packages fix security vulnerability","description":"Adobe Flash Player 26.0.0.137 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow an\nattacker to take control of the affected system.\n\nThis update resolves security bypass and memory corruption vulnerabilities\nthat could lead to information disclosure or code execution\n(CVE-2017-3080, CVE-2017-3099, CVE-2017-3100).\n","status":"published","published":"2017-07-22T08:42:57Z","modified":"2026-04-16T06:25:23.054622242Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}