# CVE-2014-8439

Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

- Page: https://www.vulneraibility.com/cve/CVE-2014-8439
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-05-25; CISA due date 2022-06-15
- EPSS: 20.37% (percentile 97.5)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-10)
- Weakness: CWE-416
- Published: 2014-11-25

## Affected

- adobe:flash_player
- adobe:air
- adobe:air_sdk
- adobe:air_sdk_\&_compiler

## References

- [other] https://exchange.xforce.ibmcloud.com/vulnerabilities/98932
- [other] https://www.f-secure.com/weblog/archives/00002768.html
- [other] http://www.securitytracker.com/id/1031259
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00004.html
- [other] http://www.securityfocus.com/bid/71289
- [advisory] http://secunia.com/advisories/60217
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00001.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00020.html
- [advisory] http://rhn.redhat.com/errata/RHSA-2014-1915.html
- [other] http://helpx.adobe.com/security/products/flash-player/apsb14-22.html
- [other] http://helpx.adobe.com/security/products/flash-player/apsb14-26.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-8439

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.