CVE-2014-8439: Adobe Flash Player Dereferenced Pointer Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 20.4% chance of exploitation in the next 30 days.

Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

Affected products

• Adobe Air: up to and including 15.0.0.292
• Adobe Air SDK: up to and including 15.0.0.301
• Adobe Air SDK & Compiler: before 15.0.0.302 (fixed in 15.0.0.302)
• Adobe Flash Player: up to and including 11.2.202.418; up to and including 15.0.0.223; up to and including 13.0.0.252

Published 2014-11-25. Last modified 2026-06-17.