CVE-2010-1297

Adobe Flash Player Memory Corruption Vulnerability

Published Jun 8, 2010 · updated Jun 16, 2026 · n/a n/a

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Jun 8, 2010 · Catalog
Detected
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruct
Jun 8, 2022 · CISA KEV
Known exploited
The impacted product is end-of-life and should be disconnected if still in use.
Jun 22, 2022 · CISA KEV
Remediation due
The impacted product is end-of-life and should be disconnected if still in use.
Jun 16, 2026 · Catalog
Updated
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruct

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date Jun 22, 2022

Affected

cpe adobe/acrobatversion unspecified
cpe adobe/airversion unspecified
cpe adobe/flash playerversion unspecified
cpe opensuse/opensuseversion unspecified
cpe suse/linux enterprise10.0
cpe suse/linux enterprise11.0
vendor Adobe Flash Playerversion unspecified
vendor n/a n/aversion unspecified

Sources

CISA KEVConfirmed exploitationCVE-2010-1297
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
cisa.gov
CVE.orgVulnerability recordCVE-2010-1297
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
cve.org
FIRST EPSSExploitation probabilityCVE-2010-1297
30-day exploitation probability 82.5%
first.org
Exploit DatabasePublic exploit reference13787
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit DatabasePublic exploit reference16614
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit DatabasePublic exploit reference16687
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit ModulesPublic exploit moduleexploit_windows/browser/adobe_flashplayer_newfunction
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
Metasploit ModulesPublic exploit moduleexploit_windows/fileformat/adobe_flashplayer_newfunction
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2010-1297
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
nvd.nist.gov