CVE-2010-1297: Adobe Flash Player Memory Corruption Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 82.5% chance of exploitation in the next 30 days.

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Affected products

• Adobe Acrobat: from 8.0, before 8.2.3 (fixed in 8.2.3); from 9.0, before 9.3.3 (fixed in 9.3.3)
• Adobe Air: before 2.0.2.12610 (fixed in 2.0.2.12610)
• Adobe Flash Player: before 9.0.277.0 (fixed in 9.0.277.0); from 10.0, before 10.1.53.64 (fixed in 10.1.53.64)
• Opensuse Opensuse: from 11.0, up to and including 11.2
• Suse Linux Enterprise: version 10.0 only; version 11.0 only

Published 2010-06-08. Last modified 2026-06-16.