Intel

CVE-2014-0502

Adobe Flash Player — Adobe Flash Player Double Free Vulnerablity

criticalKEV: actively exploitedPoCEPSS 24.8%

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2014-0502 carries a CVSS v2 score of 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) and sits at the 97.7th EPSS percentile, indicating an extremely high probability of active exploitation relative to the broader vulnerability population. The vulnerability was weaponised in targeted drive-by and malvertising campaigns as early as February 2014, and its appearance on the CISA KEV list in September 2024 confirms that unpatched Flash installations persist in operational environments a decade later. For NIS2-scoped organisations, any remaining Flash Player instance represents an unmitigated remote code execution surface with no vendor support path — the attack requires no authentication and no user interaction beyond visiting a malicious or compromised page. Treat removal or isolation of Flash as the highest-priority remediation action this cycle, ahead of lower-CVSS items with active patches.

Runbook · Step 1

Immediate response (0-24 h)

  • Patch Adobe Flash Player immediately: Windows and macOS to version 12.0.0.70 or later; Linux to version 11.2.202.341 or later. Refer to Adobe Security Bulletin APSB14-07 for the exact download URL.
  • Update Adobe AIR (all platforms including Android), Adobe AIR SDK, and AIR SDK & Compiler to version 4.0.0.1628 or later.
  • Where immediate patching is not feasible (e.g. legacy production systems), isolate affected hosts from the internet or enforce outbound HTTP/HTTPS traffic through a TLS-inspecting proxy that blocks uncategorised or malvertising-classified destinations.
  • Disable Flash Player in all browsers organisation-wide (enforce Click-to-Play or remove the plugin entirely via GPO/MDM) until the patch is confirmed deployed — prioritise internet-facing workstations.
  • Review least-privilege posture on affected systems; force re-authentication for any privileged sessions (local admin, domain admin) that were active on unpatched hosts.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move endpoints without a hard Flash dependency into a restricted VLAN; block outbound connections to exploit-kit and malvertising categories at the NGFW or proxy layer.
  • WAF/IPS rule: Enable Suricata/Snort rules targeting SWF files with anomalous heap-spray patterns (e.g. Suricata rule class exploit.swf); configure the email gateway to strip inbound SWF attachments.
  • Browser hardening: Use GPO to disable the Flash plugin in Internet Explorer, Chrome (HKLM\SOFTWARE\Policies\Google\Chrome\PluginsDisabledForUrls), and Firefox (plugin.state.flash = 0).
  • Endpoint hardening: Enable Microsoft EMET or Windows Defender Exploit Guard on affected Windows hosts; enforce DEP and ASLR specifically for FlashPlayerPlugin_*.exe to raise the exploitation cost of the double-free primitive.
  • IAM/least-privilege: Confirm browser processes do not run with elevated rights; verify AppLocker policy prevents FlashPlayerPlugin_*.exe from launching out of temporary or user-writable directories.

Runbook · Step 3

Detection rules

  • Sysmon EID 1 / process ancestry: Alert when FlashPlayerPlugin_*.exe or plugin-container.exe spawns a child shell. Sigma shape: ParentImage|endswith: 'FlashPlayerPlugin' AND Image|endswith: 'cmd.exe'
  • Sysmon EID 3 / network connection: Flag outbound connections initiated by FlashPlayerPlugin_*.exe to unknown external IPs on port 80/443 following SWF content delivery — baseline deviation is the trigger.
  • Windows Event ID 4688: Configure a high-severity alert for the process tree iexplore.exe → FlashPlayerPlugin → cmd.exe or any equivalent shell spawn from the Flash plugin process.
  • Proxy/web logs: HTTP responses with Content-Type: application/x-shockwave-flash from uncategorised external domains. SPL snippet: index=proxy content_type="application/x-shockwave-flash" NOT dest_category=trusted | stats count by src, dest
  • EDR telemetry: Create a custom IOA rule in CrowdStrike Falcon or Microsoft Defender for Endpoint targeting FlashPlayerPlugin processes exhibiting anomalous memory allocation/free patterns consistent with heap-spray activity.

Description

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

Source: CISA KEV CatalogCVE.org (MITRE)cvelistv5

Metrics

EPSS percentile
97.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
Actively exploited
Show all metrics
Severity
critical
Priority score
183.08
Exploit maturity
actively exploited (KEV)
EPSS score
24.8 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2024-09-17 00:00 UTC

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources