CVE-2014-0502
- State
- Published
- Severity
- 8.8 High
- Published
- Feb 21, 2014
- Updated
- Oct 22, 2025
- Reserved
- Dec 20, 2013
Description
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-415 Double Free
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- openSUSE-SU-2014:0278vendor-advisory
- https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html
- GLSA-201405-04vendor-advisory
- http://helpx.adobe.com/security/products/flash-player/apsb14-07.html
- RHSA-2014:0196vendor-advisory
- SUSE-SU-2014:0290vendor-advisory
- openSUSE-SU-2014:0277vendor-advisory
- http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0502government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.