ZeroDay Findings
Sign inSign up

Findings

CVE-2014-9163

Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

Published Dec 10, 2014 · updated Jun 16, 2026 · adobe flash player

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2014 · Catalog

    Detected

    Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

  2. Apr 13, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. May 4, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date May 4, 2022

Affected

  • cpe adobe/flash playerversion unspecified
  • vendor Adobe Flash Playerversion unspecified

Sources

  • CISA KEVCVE-2014-9163

    Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.

    cisa.gov
  • CVE.orgCVE-2014-9163

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2014-9163

    30-day exploitation probability 20.7%

    first.org
  • NIST NVDCVE-2014-9163

    Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

    nvd.nist.gov

References