{"id":"CVE-2019-0612","aliases":["EUVD-2019-1376","GHSA-2467-gpx7-r99c"],"status":"published","title":"A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge...","description":"A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.10514,"percentile":0.95799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2019-04-08T22:34:25Z","modified":"2026-06-17T02:08:32Z","exploits":[{"source":"exploitdb","id":"EDB-46569","title":"Microsoft Edge - Flash click2play Bypass with CObjectElement::FinalCreateObject","type":"dos","platform":"windows","date":"2019-03-19","verified":true,"url":"https://www.exploit-db.com/exploits/46569"}],"products":[{"vendor":"microsoft","product":"edge"},{"vendor":"microsoft","product":"microsoft edge"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0612","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0612"},{"url":"https://github.com/advisories/GHSA-2467-gpx7-r99c"}],"sources":{"cve":[{"id":"CVE-2019-0612","description":"A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.","status":"published","published":"2019-04-08T22:34:25Z","modified":"2024-08-04T17:51:27.247Z","updated_at":"2026-11-02T14:32:24.110857Z"}],"euvd":[{"id":"EUVD-2019-1376","description":"A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.","status":"published","published":"2019-04-08T22:34:25Z","modified":"2024-08-04T17:51:27Z","updated_at":"2026-11-03T03:07:01.057767Z"}],"ghsa":[{"id":"GHSA-2467-gpx7-r99c","title":"A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge...","description":"A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.","status":"published","published":"2022-05-13T01:21:22Z","modified":"2023-02-01T05:06:24Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:50:21.264393Z"}],"nvd":[{"id":"CVE-2019-0612","description":"A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.","status":"published","published":"2019-04-08T23:29:00.493Z","modified":"2026-06-17T02:08:32.217Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:05:11.426883Z"}]}}