CVE-2014-8439: Adobe Flash Player Dereferenced Pointer Vulnerability
CVE-2014-8439 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2022-05-25
Adobe Flash Player and AIR contain a vulnerability in the handling of dereferenced memory pointers. Attackers can exploit this via unspecified vectors to execute arbitrary code or cause a denial of service.
Yes. CVE-2014-8439 is known to be exploited in the wild, first recorded on 25 May 2022. Treat it as urgent.
How severe is CVE-2014-8439?
Critical severity, with a CVSS score of 10, published 25 May 2022.
Which products and versions are affected?
Adobe Flash Player before 13.0.0.258, 14.x and 15.x before 15.0.0.239 (Windows/OS X); before 11.2.202.424 (Linux); Adobe AIR before 15.0.0.293; Adobe AIR SDK before 15.0.0.302; Adobe AIR SDK & Compiler before 15.0.0.302.
Is there a fix for CVE-2014-8439?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2014-8439 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2014-8439?
Check whether you run Adobe AIR or Adobe Flash Player. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Adobe Flash Player before 13.0.0.258, 14.x and 15.x before 15.0.0.239 (Windows/OS X); before 11.2.202.424 (Linux)
Adobe AIR before 15.0.0.293
Adobe AIR SDK before 15.0.0.302
Adobe AIR SDK & Compiler before 15.0.0.302
Timeline
2014-11-25: disclosed: Initial vendor advisory APSB14-26 published
2022-05-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-05-25: other: NVD publication date
2014-11-25: exploited: Reported as exploited in the wild in original advisory context