Flash PlayerApplication · Adobe

CVE-2014-8440

HIGH · 10.0 CVSS v2.0 Published 2014-11-11

Fix available

A fix is available. Upgrade to 11.2.202.418 / 13.0.0.252 or later.

See remediation →

100/100

Remediation priority · Urgent

High EPSS Public exploit Remotely reachable No privileges Zero-click Patch available

Official description

NVD · unedited

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8441.

Technical summary

dbcve analysis · moderate confidence

Memory corruption vulnerability in Adobe Flash Player and Adobe AIR allowing arbitrary code execution or denial of service. The vulnerability affects multiple versions across Windows, OS X, and Linux platforms via unspecified vectors.

MitigationUpdate Adobe Flash Player to version 13.0.0.252 (Windows/OS X) or 11.2.202.418 (Linux), and Adobe AIR to version 15.0.0.356 or later to remediate this vulnerability.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions

NVD · CPE data

Flash PlayerApplication

Affected:>= 13.0, < 13.0.0.252>= 14.0, <= 14.0.0.179>= 15.0, < 15.0.0.223>= 11.0, < 11.2.202.418

Air SdkApplication

Affected:<= 15.0.0.356

AirApplication

Affected:<= 15.0.0.356

Air Sdk \& CompilerApplication

Affected:< 15.0.0.356

CVSS breakdown

From the vector

Attack vector: Network
Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

Am I affected?

dbcve checks

Work through these to decide whether this CVE applies to you.

Check Adobe Flash Player version on Windows

Open Control Panel > Programs and Features, locate Adobe Flash Player, or open a browser and navigate to https://helpx.adobe.com/flash-player.html to verify the installed version. Alternatively, check the file version of flash32.ocx or flash64.ocx in C:\Windows\System32\Macromed\Flash\

Affected if The installed version is 13.0.0.0 through 13.0.0.251, 14.0.0.0 through 14.0.0.179, 15.0.0.0 through 15.0.0.222, or 11.0.0.0 through 11.2.202.417
Check Adobe Flash Player version on macOS

Open Finder > Applications > Utilities > System Information, select Graphics/Displays, and check the Flash Player version. Or locate Adobe Flash Player in /Library/Application Support/Adobe/Flash Player/ and check the version info via Get Info.

Affected if The installed version is 13.0.0.0 through 13.0.0.251, 14.0.0.0 through 14.0.0.179, 15.0.0.0 through 15.0.0.222, or 11.0.0.0 through 11.2.202.417
Check Adobe Flash Player version on Linux

Open a terminal and run rpm -q flash-plugin or dpkg -l | grep flash, or check the version via the browser's plugin page at about:plugins.

Affected if The installed version is 13.0.0.0 through 13.0.0.251, 14.0.0.0 through 14.0.0.179, 15.0.0.0 through 15.0.0.222, or 11.0.0.0 through 11.2.202.417
Check Adobe AIR version on Windows or macOS

Open Control Panel (Windows) or Applications folder (macOS), locate Adobe AIR, and check the version. On Windows, also check C:\Program Files (x86)\Adobe\Adobe AIR\Versions\1.0 for the version file, or on macOS check /Library/Application Support/Adobe/AIR/

Affected if The installed version is 15.0.0.356 or any version lower than 15.0.0.356
Check Adobe AIR SDK version

Locate the AIR SDK installation directory and check the version file, or run the AIR SDK version command if available. Common paths include C:\Program Files (x86)\Adobe\Adobe AIR SDK\ or check the SDK's readme or version manifest file.

Affected if The installed AIR SDK version is 15.0.0.356 or lower

A user is affected if Adobe Flash Player version falls within any of the vulnerable ranges (11.0-11.2.202.417, 13.0-13.0.0.251, 14.0-14.0.0.179, or 15.0-15.0.0.222) or if Adobe AIR/SDK version is 15.0.0.356 or lower.

Generated from the published advisory. Verify against your own configuration.

Remediation

dbcve · scoped

Upgrade available Upgrade to 11.2.202.418 / 13.0.0.252 / 15.0.0.223 or later

Fixed in 11.2.202.41813.0.0.25215.0.0.223

Vendor patch helpx.adobe.com →

Interim mitigation

Update Adobe Flash Player to version 13.0.0.252 (Windows/OS X) or 11.2.202.418 (Linux), and Adobe AIR to version 15.0.0.356 or later to remediate this vulnerability.

Recommended fix High confidence

Flash Player 13.0.0.252 / 14.0.0.179 / 15.0.0.223 / 11.2.202.418 (Linux); Adobe AIR 15.0.0.356; Adobe AIR SDK 15.0.0.356

Identify the currently installed version of Adobe Flash Player and Adobe AIR on the system
For Flash Player: Navigate to http://helpx.adobe.com/flash-player.html and download version 13.0.0.252 (for 13.x users), 14.0.0.179 (for 14.x users), 15.0.0.223 (for 15.x users), or 11.2.202.418 (for Linux 11.x users)
For Adobe AIR: Download and install version 15.0.0.356 or later from the Adobe AIR download page
For Adobe AIR SDK: Upgrade to AIR SDK version 15.0.0.356 or later from the Adobe AIR SDK download page
Restart any browsers or applications that use Flash Player after installation
Verify the installed version matches the target fixed version by checking Help > About Adobe Flash Player (or About Adobe AIR)

Caveat Adobe has ended Flash Player support for many platforms; ensure browser compatibility before upgrading; some legacy Flash content may not function in newer versions

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Flash Player Scoped from the published advisory

Consultation1.0 h
Implementation2.0 h
Testing1.0 h
Review / QA1.0 h

5.0 hours of engineering $890

Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,424.

Scan for this in your stack

Free · runs locally

dbcve dependency scanner

Check whether your project pulls in CVE-2014-8440 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References

Primary sources

helpx.adobe.comPatch / commit
www.exploit-db.comProof of Concept
helpx.adobe.comPatchVendor Advisory
lists.opensuse.orgMailing ListThird Party Advisory
www.securityfocus.comThird Party AdvisoryVDB Entry
exchange.xforce.ibmcloud.comThird Party AdvisoryVDB Entry
www.exploit-db.comExploitThird Party AdvisoryVDB Entry
www.verisign.comThird Party Advisory
nvd.nist.govNVD record

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2014-8440 in production — separate from our analysis above.

Notes0 Guidelines

Know something about CVE-2014-8440?

The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.

The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here

Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data

At a glance

A fix existsUpgrade to 11.2.202.418 / 13.0.0.252 or later

Severity 10.0 High

Exploit likelihood EPSS, next 30 days 81.9%

Affects: Flash Player

Remediation

A high-priority fix

Fix this in Flash Player 5 hrs · Low

Typical engagement from $890

Get a fix See the full breakdown ↓

A high-priority vulnerability. Send your environment and a specialist will scope CVE-2014-8440 and return a fixed quote and timeline.

You’ll deal with our team directly and deploy the reviewed fix to staging first — never straight to production.

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

Check your environment

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

Scan for this in your stack

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Practitioner notes

No notes yet

Official description

Technical summary

Affected products & versions

CVSS breakdown

Am I affected?

Remediation

References