{"id":"CVE-2017-11292","published":"2017-10-22T19:29:00Z","modified":"2026-06-17T01:01:33Z","title":"Adobe Flash Player Type Confusion Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":{"product":"Adobe Flash Player","since":"2020-12-31","note":"No security updates; remove it."},"description":{"text":"Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Flash Player has a flaw in its bytecode verification procedure that lets an untrusted value be used when calculating an array index, resulting in type confusion. An attacker can achieve arbitrary code execution by exploiting this without authentication over the network, provided a user interacts with content (such as opening a crafted page or file).","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:56Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.11885,"percentile":0.96086,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11292","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-10-10","exploitedFirstSeen":"2017-10-10","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2017-10-10"},{"url":"https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/","date":"2017-10-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type"}],"references":[{"url":"http://www.securityfocus.com/bid/101286","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039582","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2899","tags":["Third Party Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-32.html","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-22","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/101286","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039582","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2899","tags":["Third Party Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-32.html","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-22","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Type Confusion","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.","confidence":"high"},{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Type Confusion","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Type Confusion","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Type Confusion","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-2926","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-2926","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1566.001","T1204.002"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"secondary","techniques":["T1005"],"provenance":"source"}],"timeline":[{"date":"2017-10-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2017-10-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11292","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-2926","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1593},"priority":{"score":48.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3306 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.22,"detail":"percentile 0.9609"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]}}