CVE-2011-0609: Adobe Flash Player Unspecified Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 63.5% chance of exploitation in the next 30 days.

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

Affected products

• Adobe Acrobat: from 9.0, up to and including 9.4.2; version 10.0 only; version 10.0.1 only
• Adobe Acrobat Reader: from 9.0, up to and including 9.4.2; version 10.0 only; version 10.0.1 only
• Adobe Air: up to and including 2.5.1
• Adobe Flash Player: up to and including 10.2.154.13; up to and including 10.1.106.16
• Google Chrome: before 10.0.648.134 (fixed in 10.0.648.134)
• Opensuse Opensuse: version 11.2 only; version 11.3 only; version 11.4 only
• Suse Linux Enterprise: version 10.0 only; version 11.0 only

Published 2011-03-15. Last modified 2026-06-16.