CVE-2014-0502: Adobe Flash Player

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run Adobe Flash Player. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2024-09-17, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2024-10-08; treat that as the outer limit, not the target.
EPSS 24.8%, percentile 98: FIRST’s model estimates a 24.8% chance of exploitation activity in the next 30 days, higher than 98% of all scored CVEs (very high). EPSS is a probability, not a verdict.
Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.

What it is

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

CISA’s summary

Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.

Weakness type: CWE-415, CWE-399.

Product: Adobe Flash Player · Assigned by: adobe · Published: 2014-02-21

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
n/a	n/a	see vendor advisory

Severity scores

Scored by	CVSS	Score	Vector
CISA-ADP	3.1	8.8 High	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Attack vector: network (remotely reachable)
Attack complexity: low
Privileges required: none (no login)
User interaction: required (a user must click/open something)
Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2024-09-17; federal due date 2024-10-08. Known ransomware use: Unknown.
CISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA SSVC assessment: exploitation active, automatable yes, technical impact total.
FIRST EPSS (model of 2026-10-21): 24.82% probability of exploitation activity in the next 30 days; percentile 98.

Timeline

2014-02-21 — CVE record published by adobe
2024-09-17 — Added to CISA’s Known Exploited Vulnerabilities catalog
2024-10-08 — CISA remediation deadline for US federal agencies
2025-10-22 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Other references from the CVE record and advisory

volatility-labs.blogspot.com volatility-labs.blogspot.com
helpx.adobe.com helpx.adobe.com
alienvault.com alienvault.com

All exploited Adobe vulnerabilities · Today’s Security Digest