CVE-2010-1297 KEVPublic exploit High · 7.8 EPSS 82.5%

Adobe Flash Player Memory Corruption Vulnerability

Adobe · Flash Player

Summary

Adobe Flash Player (before 9.0.277.0 and 10.x before 10.1.53.64, along with the related Adobe AIR, Reader and Acrobat builds listed) contains a memory corruption flaw in the authplay.dll component and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction handling. An attacker can execute arbitrary code or cause a denial of service by delivering crafted SWF content to a user on Windows or Mac OS X, requiring no authentication but user interaction such as opening or viewing the malicious content.

Official description · NVD

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Breakdown

72.3 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Infect visitors through a malicious websiteT1189 · Drive-by CompromiseSource data3 general detection rules
- Trick a user into opening a fileT1204.002 · Malicious FileSource data39 general detection rules
What they do
- Download more tools onto the systemT1105 · Ingress Tool TransferSource data87 general detection rules

First seen exploited the day it was disclosed. Public exploit code (Metasploit) was available 4 days before disclosure.

Public exploit codeMetasploit4 Jun 20104 days before
DisclosedFirst seen exploitedVulnCheck KEV evidence8 Jun 2010day 0
Added to CISA KEVEU database agrees8 Jun 2022+12 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

3 , grouped by in kill-chain order 3

Initial AccessTA0001

Drive-by Compromise T1189

MITRE CTID mapping of the KEV entry · how it is exploited

This vulnerability is exploited by crafted swf content via drive-by compromise when a user visits a malicious website. This vulnerability is also exploited via user execution of a maliciously crafted pdf file. In the wild, threat actors have used this to download malicious software onto the target system.

ExecutionTA0002

Malicious File T1204.002

MITRE CTID mapping of the KEV entry · how it is exploited

Command and ControlTA0011

Ingress Tool Transfer T1105

MITRE CTID mapping of the KEV entry · primary impact

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploitation for Client ExecutionT1203 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 129 general rules for its techniques

Rules for this CVE

0 that reference CVE-2010-1297 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules

Cross Site Scripting Stringshightest
Flash Player Update from Suspicious Locationhightest
Suspicious Browser Child Process - MacOSmediumtest

Malicious FileT1204.00239 general rules

Droppers Exploiting CVE-2017-11882criticalstable
Ursnif Malware C2 URL Patterncriticalstable
Exploit for CVE-2017-8759criticaltest
Potential Maze Ransomware Activitycriticaltest
File With Uncommon Extension Created By An Office Applicationhightest
Flash Player Update from Suspicious Locationhightest
GAC DLL Loaded Via Office Applicationshightest
HackTool - LittleCorporal Generated Maldoc Injectionhightest

All 39 on SigmaHQ ↗

Ingress Tool TransferT110587 general rules

Greenbug Espionage Group Indicatorscriticaltest
Pandemic Registry Keycriticaltest
Curl Download And Execute Combinationhightest
File Download And Execution Via IEExec.EXEhightest
File Download From IP Based URL Via CertOC.EXEhightest
File Download Using Notepad++ GUP Utilityhightest
File Download Via Bitsadmin To A Suspicious Target Folderhightest
File Download Via Windows Defender MpCmpRun.EXEhightest

All 87 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportMicrosoft

Reports are matched by finding the exact id CVE-2010-1297 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Microsoft Security

Flash Player in recent years, including adopting the Control Flow Guard technology in Windows 10, which makes memory 0.000% 0.005% 0.010% 0.015% 0.020% 0.025% 0.030% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/ShellCode CVE-2010-3653 CVE-2011-0611 SWF/Netis CVE-2010-1297…

2 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

44 links, grouped by NVD tag (43 duplicates merged)

Show 4 moreShow fewer

exploit-db.com/exploits/13787 securityfocus.com/bid/40586 securityfocus.com/bid/40759 exchange.xforce.ibmcloud.com/vulnerabilities/59137

Exploit 1

blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/

Broken Link 20

community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 secunia.com/advisories/40144 secunia.com/advisories/40545 secunia.com/advisories/43026 support.apple.com/kb/HT4435 osvdb.org/65141 redhat.com/support/errata/RHSA-2010-0464.html

Show 12 moreShow fewer

Not Applicable 2

adobe.com/support/security/bulletins/apsb10-14.html adobe.com/support/security/bulletins/apsb10-15.html

Exploitation evidence

Exploited in the wild

Listed since 8 Jun 2022. Federal due date 22 Jun 2022. No recorded ransomware use.

The impacted product is end-of-life and should be disconnected if still in use.

ENISA

Marked exploited since 8 Jun 2022. EUVD-2010-1326

Adobe Flash / Reader - Live MalwareEDB-13787 · remote · multiple · 2010-06-09 · verified
Adobe Acrobat Reader and Flash Player - 'newclass' Invalid PointerEDB-14853 · remote · windows · 2010-09-01 · verified
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (1)EDB-16614 · local · windows · 2010-09-20 · verified
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (2)EDB-16687 · local · windows · 2010-09-25 · verified

, 30 Oct 2026

82.5%Top 0.34%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.66%).

3.1

7.8High · 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 5989 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9966 19.9/20

Threat reports1 report 3.9/10

Public exploit code1 NVD reference tagged Exploit; 4 Exploit-DB entries; 1 NVD exploit link; 2 Metasploit modules 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.8 5.5/7

End-of-life productsupported or unknown 0.0

Total72.3

Record

Published: 8 Jun 2010
Modified: 16 Jun 2026
: CWE-787 Out-of-bounds Write
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques