Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2014-0502

CVE-2014-0502HIGH

n/a n/a — Adobe Flash Player

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .2482   97.9   YES

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Dec 20  Reserved by adobe
  Feb 21  Published (CNA: adobe)
  Sep 17  Added to CISA KEV, remediation due 2024-10-08

CWE-415 · CNA: adobe · CVSS v3.1 · 9 references · KEV due October 8, 2024

Description

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 20, 2013	Reserved	Reserved by adobe
February 21, 2014	Published	Published (CNA: adobe)
September 17, 2024	KEV ADDED	Added to CISA KEV, remediation due 2024-10-08

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	n/a	—	n/a	—

Weaknesses

CWE-415

References (9)

http://helpx.adobe.com/security/products/flash-player/apsb14-07.html [x_refsource_CONFIRM]
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html [vendor-advisory, x_refsource_SUSE]
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html [vendor-advisory, x_refsource_SUSE]
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html [vendor-advisory, x_refsource_SUSE]
http://rhn.redhat.com/errata/RHSA-2014-0196.html [vendor-advisory, x_refsource_REDHAT]
http://security.gentoo.org/glsa/glsa-201405-04.xml [vendor-advisory, x_refsource_GENTOO]
http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/ [x_refsource_MISC]
https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0502 [government-resource]

Authoritative record: CVE-2014-0502 at cve.org

Weaknesses: CWE-415

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2014-0502 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.