HackZoneLabs News
Newsletter

CVE-2011-0611

Adobe Flash Player Remote Code Execution Vulnerability

  • High 8.8
  • Exploited: added to CISA KEV 3 Mar 2022
  • A public exploit reference is listed

Description

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

Key facts

Published
13 Apr 2011
Last changed
22 Oct 2025
Assigned by
adobe
KEV added
3 Mar 2022
KEV fix due
24 Mar 2022
EPSS
99.41% likely to be exploited in the next 30 days, higher than 99.942% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: no; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 8.8CVSS 3.1, Highfrom CISA (ADP container)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What to do

  • The impacted product is end-of-life and should be disconnected if still in use.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
n/an/a
  • n/a (affected)

Timeline

  1. 13 Apr 2011 Published
  2. 3 Mar 2022 CVE-2011-0611 added to CISA KEV
  3. 3 Mar 2022 Added to the CISA KEV catalogue

Weakness

References