CVE-2017-3114

Vulnerability

An out-of-bounds read vulnerability exists in Adobe Flash Player up to and including version 27.0.0.183 [1][2]. The flaw occurs when the player computes an invalid pointer offset during the processing of language-, region-, or country-specific functionality, leading to a read past the end of an internal buffer [1].

Exploitation

An attacker can exploit this issue by crafting a malicious SWF file and convincing a victim to load it, typically through a web page or email attachment. No authentication or special network position is required; the victim simply needs to launch the SWF in an affected Flash Player [1][2]. The vulnerability can be triggered without user interaction beyond opening the malicious content [1].

Impact

Successful exploitation allows an attacker to read sensitive data from the victim's system, potentially exposing memory contents that could include credentials, session tokens, or other confidential information [1]. The vulnerability is rated as Critical (CVSS 9.8) and has been linked to arbitrary code execution in related advisories [1][2].

Mitigation

Adobe released Flash Player version 27.0.0.187 to address this vulnerability [1][2]. Red Hat provided updated flash-plugin packages for Red Hat Enterprise Linux 6 [1], and Gentoo recommended upgrading to >=www-plugins/adobe-flash-27.0.0.187 [2]. No workaround is available if the player remains unpatched [2]. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.