CVE-2007-6019: Adobe Air

High severity, CVSS 9.3. EPSS: 59.8% chance of exploitation in the next 30 days.

Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being instantiated properly.

Affected products

• Adobe Air: version 1.0 only
• Adobe Flash: version basic only; version professional only
• Adobe Flash Player: up to and including 9.0.115.0; version 7.0 only; version 7.0.1 only; version 7.0.25 only; version 7.0.63 only; version 7.0.69.0 only; …
• Adobe Flex: version 3.0 only

Published 2008-04-09. Last modified 2026-06-16.