ZeroDay Findings
Sign inSign up

Findings

CVE-2010-1297

Adobe Flash Player Memory Corruption Vulnerability

Published Jun 8, 2010 · updated Jun 16, 2026 · adobe air

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 8, 2010 · Catalog

    Detected

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruct

  2. Jun 8, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. Jun 22, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruct

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date Jun 22, 2022

Affected

  • cpe adobe/acrobatversion unspecified
  • cpe adobe/airversion unspecified
  • cpe adobe/flash playerversion unspecified
  • cpe opensuse/opensuseversion unspecified
  • cpe suse/linux enterprise10.0
  • cpe suse/linux enterprise11.0
  • vendor Adobe Flash Playerversion unspecified

Sources

  • CISA KEVCVE-2010-1297

    Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

    cisa.gov
  • CVE.orgCVE-2010-1297

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2010-1297

    30-day exploitation probability 82.5%

    first.org
  • Exploit Database13787

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database16614

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database16687

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_windows/browser/adobe_flashplayer_newfunction

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_windows/fileformat/adobe_flashplayer_newfunction

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2010-1297

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corrupt

    nvd.nist.gov

References