CVE-2017-2998

—

CVSS 3.1

8.8 high

EPSS

4%p90

Published

Mar 14, 2017 (Mar 14, 2017)

Modified

Jun 17, 2026

Description

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions. Successful exploitation could lead to arbitrary code execution.

Vendors: adobe
Products: flash player, flash player desktop runtime
Weakness: CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.1%)

In the news2 stories

Security updates fix critical vulnerabilities in Flash player and Shockwave player

Security AffairsMar 14, 19:58 UTC · Mar 14, 2017Vulnerability CVE-2017-2997 CVE-2017-2998 CVE-2017-2999+5 CVEs

Palo Alto Networks Unit 42 Vulnerability Research March 2017 Disclosures

Palo Alto Unit 42Jan 28, 21:30 UTC · Jan 28, 2022Vulnerability CVE-2017-2997 CVE-2017-2998 CVE-2017-2999