PatchTheCVECVE-2017-11225: An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions
CVE-2017-11225 is a critical-severity flaw (CVSS 9.8) affecting enterprise linux desktop, enterprise linux server, enterprise linux workstation. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
Why this priority
- Critical severity
- EPSS top 7%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 6.1% (top 7%) |
| CISA exploited list | No |
| Weakness | CWE-416 |
| Published | 2017-12-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-11225?
enterprise linux desktop: mitigate or apply the listed mitigation; enterprise linux server: mitigate or apply the listed mitigation; enterprise linux workstation: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2017-11225 being exploited?
CVE-2017-11225 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-11225 affect?
CVE-2017-11225 affects enterprise linux desktop, enterprise linux server, enterprise linux workstation. Severity is critical (CVSS 9.8). An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can
How urgent is CVE-2017-11225?
Priority 68/100. Critical severity; EPSS top 7%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2017-5436 HIGH 8.8 MITIGATE MITIGATE An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font
- CVE-2018-1061 MEDIUM 6.5 UPGRADE MITIGATE python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking
- CVE-2018-11784 MEDIUM 4.3 UPGRADE MITIGATE When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 re
- CVE-2016-6794 MEDIUM 5.3 UPGRADE MITIGATE When a SecurityManager is configured, a web application's ability to read system properties should be controll
- CVE-2016-10165 HIGH 7.1 UPGRADE MITIGATE The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive