Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.
In plain language
Written by AI from the record
This is an old, very serious Adobe Flash Player bug that lets a booby-trapped video or Flash file take over a computer if someone opens it, but Flash Player is long dead and shouldn't be running on your systems anymore.
An integer overflow in Adobe Flash Player 9.0.45.0 and earlier (triggered by an oversized length value in a Long string or XML variable inside a crafted FLV/SWF file) causes a signed-comparison error that can lead to remote code execution when the victim opens the file.
If you're affected
Full computer takeover
Malware installation
Data theft from infected machine
Operational disruption
What is it
Think of this like a mail slot that's supposed to only accept small envelopes, but a flaw lets someone shove in an oversized, rigged envelope that breaks the lock and lets them walk right into the house. Here, the 'house' is any computer running an old version of Adobe Flash Player, and the 'envelope' is a tampered video or animation file. If someone opens that file, the attacker can run their own commands on that computer.
Who is affected
This matters to you if any computer, point-of-sale system, or old internal tool in your business still uses Adobe Flash Player version 9.0.45.0 or earlier, or any unsupported Flash installation. It is only a risk if someone on that machine actually opens a malicious video/animation file — simply having Flash installed without opening such a file is not enough to trigger it.
How urgent is it
There is no confirmed active exploitation of this specific flaw in the wild and it is not on any government list of currently-attacked vulnerabilities, so this is not an emergency fire-drill today. However, the flaw is severe (full takeover with no login needed) and Flash Player itself is no longer supported by Adobe, so any lingering installation should be treated as a standing risk to clean up soon rather than ignore.
What to do — in detail
Inventory all endpoints, kiosks, legacy web applications, and embedded systems for any installation of Adobe Flash Player at or below version 9.0.45.0, or any Flash ActiveX/plugin component at all. There is no 'fixed' current version to upgrade to — Adobe ended all support and distribution of Flash Player in January 2021, so the only durable remediation is complete removal of the Flash runtime (ActiveX control, NPAPI plugin, and standalone player) and replacement of any dependent workflow with an HTML5 or native alternative. If removal must be delayed, isolate affected hosts from internet access, disable automatic Flash content execution in browsers/document viewers, and block FLV/SWF file types at the email/web gateway. There is no CISA KEV entry and no public exploit code on record for this CVE, and press attention is unconfirmed, so prioritize this as a cleanup/hardening task rather than an active-incident response — but track it, since the historical EPSS score (high percentile, though currently trending down) indicates this class of Flash integer-overflow bug was historically attractive to attackers. Monitor for any unexpected Flash/ActiveX crash reports or unusual outbound connections from legacy machines still running Flash.
Technical context
CVSS 9.3 (Critical, AV:N/AC:M/Au:N/C:C/I:C/A:C) reflects network-exploitable, no-authentication, high-impact remote code execution, though exploitation requires user interaction (opening a crafted file) and medium attack complexity. The weakness is CWE-189 (integer overflow): a signed comparison on a length field assumed non-negative allows an attacker-supplied oversized Long string or XML variable length in an FLV/SWF file to overflow and corrupt memory, enabling arbitrary code execution. No KEV listing and no public exploit code are on record, and EPSS modeled a historically high likelihood of exploitation (99th percentile) with a currently falling trend, consistent with an aged, largely deprecated attack surface rather than live targeting today. Exploit maturity is unproven in current findings. Remediation is full product removal, as Adobe has end-of-lifed Flash Player with no supported patched version remaining.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
