CVE-2009-0520: Adobe Air

High severity, CVSS 9.3. EPSS: 28.5% chance of exploitation in the next 30 days.

Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."

Affected products

• Adobe Air: version 1.5 only
• Adobe Flash Player: up to and including 10.0.12.36; version 7.0 only; version 7.0.1 only; version 7.0.25 only; version 7.0.63 only; version 7.0.69.0 only; …
• Adobe Flash Player For Linux: up to and including 10.0.15.3
• Adobe Flex: version 3.0 only

Published 2009-02-26. Last modified 2026-06-16.