CVE-2014-9163: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

Patch now

HIGH 7.8EXPLOITEDUPGRADE

CVE-2014-9163 is a high-severity flaw (CVSS 7.8) affecting flash player, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	44.9% (top 1%)
CISA exploited list	Yes, fix due 2022-05-04
Weakness	CWE-121
Published	2014-12-10
Last modified	2026-06-17

Publisher (CNA): Adobe Systems Incorporated · Vendor: adobe

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-12-10 21:59 UTCPublished CVE record published
2022-04-13Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-05-04Deadline CISA due date for US federal agencies to patch
2026-06-17 00:17 UTCUpdated Record last modified

adobe flash player UPGRADE

Affected: >= 13.0 and < 13.0.0.259 · >= 14.0 and <= 14.0.0.179 · >= 15.0 and < 15.0.0.246 · >= 11.0 and < 11.2.202.425

Fixed in: 11.2.202.425, 13.0.0.259, 15.0.0.246

Safe to downgrade to: a release before 11.0

1. Check installed version

apt-cache policy flash-player || rpm -q flash-player || flash-player --version

2. UPGRADE to 11.2.202.425 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade flash-player

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade flash-player

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 11.0 (Debian / Ubuntu)

apt-cache madison flash-player sudo apt install flash-player=<VERSION_BEFORE_11.0> sudo apt-mark hold flash-player

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list flash-player sudo dnf downgrade flash-player-<VERSION_BEFORE_11.0> sudo dnf versionlock add flash-player

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora ELN · makedumpfile · FIXED · 1.8.0-1.eln159 · FEDORA-2026-3bf4582b1f · source

sudo dnf upgrade --advisory=FEDORA-2026-3bf4582b1f

Fedora 46 · python-resend · FIXED · 2.50.1-1.fc46 · FEDORA-2026-8c29ba68cc · source

sudo dnf upgrade --advisory=FEDORA-2026-8c29ba68cc

RHEL 5 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.425-1.el5

sudo dnf upgrade --advisory=RHSA-2014:1981 rpm -q flash-plugin

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-9163?

flash player: upgrade to 11.2.202.425, 13.0.0.259, 15.0.0.246. Exact commands for each OS are on this page.

Is CVE-2014-9163 being exploited?

Yes. CVE-2014-9163 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2014-9163 affect?

CVE-2014-9163 affects flash player. Severity is high (CVSS 7.8). Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in

How urgent is CVE-2014-9163?

Priority 77/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV)

Software pages

Windows vulnerabilities · Adobe Flash vulnerabilities

Related CVEs

CVE-2018-15982 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Adobe Flash Player Use-After-Free Vulnerability
CVE-2016-1019 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Adobe Flash Player Arbitrary Code Execution Vulnerability
CVE-2016-4117 CRITICAL 9.8 EXPLOITED UPGRADE MITIGATE Adobe Flash Player Arbitrary Code Execution Vulnerability
CVE-2011-0627 HIGH 8.8 UPGRADE Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Andro
CVE-2020-9746 HIGH 7.0 UPGRADE UPGRADE Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vu

References

← Back to latest CVEs