Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2014-8439: Adobe Flash Player Dereferenced Pointer Vulnerability

80
Patch now
HIGH 8.8EXPLOITEDUPGRADEUPGRADEUPGRADE

CVE-2014-8439 is a high-severity flaw (CVSS 8.8) affecting flash player, air, air sdk, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

Why this priority

  • High severity
  • EPSS top 3%: very likely to be exploited
  • Exploited in the wild (CISA KEV)

A fixed release or distro patch exists.

Risk facts

CVSS score8.8 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionRequired
EPSS exploit chance20.4% (top 3%)
CISA exploited listYes, fix due 2022-06-15
WeaknessCWE-119, CWE-416
Published2014-11-25
Last modified2026-06-17
Publisher (CNA): Adobe Systems Incorporated · Vendor: adobe

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

adobe flash player UPGRADE
Affected: <= 11.2.202.418 · <= 15.0.0.223 · <= 13.0.0.252
Fixed in: newer than 15.0.0.223
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 15.0.0.223 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe air UPGRADE
Affected: <= 15.0.0.292
Fixed in: newer than 15.0.0.292
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy air || rpm -q air || air --version
2. UPGRADE to newer than 15.0.0.292 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade air
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade air
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe air sdk UPGRADE
Affected: <= 15.0.0.301
Fixed in: newer than 15.0.0.301
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy air-sdk || rpm -q air-sdk || air-sdk --version
2. UPGRADE to newer than 15.0.0.301 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade air-sdk
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade air-sdk
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe air sdk \& compiler UPGRADE
Affected: < 15.0.0.302
Fixed in: 15.0.0.302
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy air-sdk--compiler || rpm -q air-sdk--compiler || air-sdk--compiler --version
2. UPGRADE to 15.0.0.302 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade air-sdk--compiler
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade air-sdk--compiler
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora ELN · makedumpfile · FIXED · 1.8.0-1.eln159 · FEDORA-2026-3bf4582b1f · source
sudo dnf upgrade --advisory=FEDORA-2026-3bf4582b1f
Fedora 46 · python-resend · FIXED · 2.50.1-1.fc46 · FEDORA-2026-8c29ba68cc · source
sudo dnf upgrade --advisory=FEDORA-2026-8c29ba68cc
RHEL 5 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.424-1.el5
sudo dnf upgrade --advisory=RHSA-2014:1915 rpm -q flash-plugin
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-8439?

flash player: upgrade to newer than 15.0.0.223; air: upgrade to newer than 15.0.0.292; air sdk: upgrade to newer than 15.0.0.301. Exact commands for each OS are on this page.

Is CVE-2014-8439 being exploited?

Yes. CVE-2014-8439 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2014-8439 affect?

CVE-2014-8439 affects flash player, air, air sdk. Severity is high (CVSS 8.8). Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allo

How urgent is CVE-2014-8439?

Priority 80/100. High severity; EPSS top 3%: very likely to be exploited; Exploited in the wild (CISA KEV)

Software pages

Windows vulnerabilities · Adobe Flash vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.